View source for User:Pat Palmer/sandbox/test10

'''Cryptography''' is a branch of [[mathematics]] concerned with obscuring information and then controlling who can retrieve the information.  Cryptography has found many practical applications related to security and reliability in [[computers]], especially when connected to networks.  Cryptography is central to digital rights management (DRM) in computers and is important in the fields of [[computer science]] and [[engineering]], as well as [[mathematics]].  By encrypting a message, we can be fairly certain who sent it, fairly certain that others can’t read it, and we can determine that the message likely has not been altered. If someone scrambles a message to make it illegible, the original message is called ''plain text'', and the  scrambled message is called ''cipher text''.  ''Encryption'' is the act of turning plain text into cipher text.  ''Decryption'' is the act of turning cipher text back to plain text

There is quite a bit of [[jargon]].  The term ''cryptology'' ("the study of secrets") may refer to the field of cryptography as a whole.  [[Cryptanalysis]] or "codebreaking" may refer to the study of how to circumvent break into an encrypted message.  A ''[[cipher]]'' (or ''cypher'') is a pair of [[algorithm]]s for encryption and decryption.  The exact operation of a cipher is controlled by a ''[[key (cryptography)|key]]'', which is a secret parameter for the cipher algorithm.  

In [[colloquial]] parlance, the term "[[code (cryptography)|code]]" is often used to mean any method of encryption or meaning-concealment. In cryptography, however, ''code'' is more specific, meaning a procedure which replaces a unit of plain text with a [[code word]] (for example, <tt>apple pie</tt> replaces <tt>attack at dawn</tt>). Codes are no longer used in serious cryptography - except incidentally for such things as unit designations - since properly chosen ciphers are both more practical and secure than even the best codes, and better adapted to computers as well.

==Encryption in computers==

Encryption is used in a number of different ways in computers.  In addition to security-related tasks such as authenticating passwords and transmitting secret or private information over the internet, encryption is used to increase reliability, just for example by verifying the integrity of a file after it has been copied.

In computerized encryption and decryption, a ''key'' is a unique string used by an encryption or decryption algorithm.  Such algorithms take as input a key and plain text to be encrypted, and yield an encrypted output string.  Or conversely, they take as input a key and cipher text to be decrypted, and (if successful) yield as output the decrypted plain text string.  The cipher text produced by an encryption algorithm should bear no resemblance to the original message.

===One-way encryption===
When passwords are stored on a computer, it is essential that they be kept secret.  Thus it is recommended practice to encrypt the passwords before writing them to disk, and furthermore to prevent anyone who might find them from decrypting them.  ''One-way'' encryption involves storing an encrypted string which cannot be decrypted.  When a user later enters their password, the newly enter password is first encrypted, and then is compared to the encrypted stored string.

The password is usually encrypted as a [[hash digest]] (a large number generated by scrambling and condensing plain text letters).  An example of a hash digest is SHA-1, which dates from 1994.  The SHA-1 algorithm takes a string as input.  The algorithm is a digest because the result is a fixed-size number.  The SHA-1 algorithm always outputs a 160-bit number (20 bytes of storage).  48 decimal digits would be required to express this number, and it is usually displayed to humans as a 28-character, base-64 encoded string.  Here are some examples:

 Hello World   z7R8yBtZz0+eqead7UEYzPvVFjw=
 VB            L1SHP0uzuGbMUpT4z0zlAdEzfPE=
 vb            eOcnhoZRmuoC/Ed5iRrW7IxlCDw=
 Vb            e3PaiF6tMmhPGUfGg1nrfdV3I+I=
 vB            gzt6my3YIrzJiTiucvqBTgM6LtM=
 
In the examples above, note that even very similar strings have quite different hash digests; the hash doesn’t tell us the length of source string, or its starting character, or anything else about it.  SHA-1 is useful because it produces collision-free results.  Below is C# code for producing an SHA-1 hash digest from a string:

 Byte[] bytSource; // byte array for plain text string
 Byte[] bytHash;   // byte array for cipher string
 
 System.Text.UnicodeEncoding uEncode = new System.Text.UnicodeEncoding();
 
 System.Security.Cryptography.SHA1CryptoServiceProvider sha1 = 
       new System.Security.Cryptography.SHA1CryptoServiceProvider();
  
 // fill byte array with Unicode chars from plain text source string
 bytSource = uEncode.GetBytes(strSource);
 
 // encrypt the source byte array into the result array
 bytHash = sha1.ComputeHash(bytSource);
 
 // return a displayable base64-encoded string
 return Convert.ToBase64String(bytHash);

Hash digests are unique signatures and can be used to verify that a file has not changed.  For example, the hash digest of an XML file can be sent (along with the XML file) to verify that the file wasn’t corrupted during transmission.

===Two-way encryption===
Some approaches are said to be ''two-way'' because text messages are both encrypted ''and'' decrypted).  One approach is called ''private key'', in which both sender and receiver use the same key both to encrypt and decrypt, and no one else is given the key.  The second is called ''public key'', using one key for encrypting and a different key for decrypting. This allows users on a computer network to send their ''encrypt'' key to strangers, who can then use it to send messages back to them.  ''Public key'' exchanges are used to open up secure ''private key'' channels between strangers across the internet.

====Private-key encryption====
[[Symmetric key cryptography|Private key encryption]] requires only one key.  That key can be used either to encrypt or decrypt a message.  Both the sender and receiver must have the key, and third parties (potential intruders) must be prevented from obtaining the key.  Private-key encryption may also be called ''symmetric'', ''traditional'', ''shared-secret'', ''secret-key'', or ''conventional'' encryption.  This was the only kind of two-way encryption publicly known until [[1976]]<ref name="dh2"/>.  With this kind of encryption alone, it would not be possible to open up a new secure connection on the internet, because there would be no safe way initially to transmit the shared key to the other end of the connection without intruders being able to intercept it.  

One example of a private-key algorithm is DES (Data Encryption Standard).  DES uses a 24-character string for a key.  The DES key is treated as a pass phrase to derive a 192-bit byte array, which is the actual key.    To implement the Triple-DES algorithm, for example, encryption occurs three times: first, the plain text is encrypted; then, the encrypted result is encrypted; and then, the intermediate encryption is encrypted.  The output is a 192-bit encrypted string (known as 192-bit encryption).  The more bits in the key, the longer it takes a brute-force search to find the key.  A 192-bit key has 6.3 x 10 raised to the 57th degree possible keys.  A brute-force search of all possible keys would likely take a long time.

One practical consideration for using private key encryption is where, and how, to safely store the key on the computer so that intruders will not be able to obtain it, if they should gain access to the machine.  Simply storing the key unencrypted in a file or database is a poor strategy.  Hard coding it inside a program is also risky because it could be fished out using a decompiler or debugger.  A prefereble strategy would be to encrypt the private key and store it in a file that is protected by the file system; this way, only authorized users of the system should be able to read the file.  But then, where should one store the key used to encrypt the private key?  It becomes a recursive problem.

=====Theoretical underpinnings=====

The study of symmetric-key ciphers involves the study of [[block ciphers]] and [[stream ciphers]] and to their applications.  A block cipher is the modern embodiment of Alberti's polyalphabetic cipher: block ciphers take as input a block of plaintext and a key, and output a block of ciphertext of the same size.  Block ciphers are used in a [[Block cipher modes of operation|mode of operation]] to implement a cryptosystem.
[[Data Encryption Standard|DES]] and [[Advanced Encryption Standard|AES]] are block ciphers which have been designated [[cryptography standards]] by the US government (though DES's designation was eventually withdrawn after the AES was adopted)<ref name="aes">[http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdf FIPS PUB 197: The official Advanced Encryption Standard].</ref>.  Despite its delisting as an official standard, DES (especially its still-approved and much more secure [[triple-DES]] variant) remains quite popular; it is used across a wide range of applications, from ATM encryption<ref name="atm">[http://www.ncua.gov/letters/2004/04-CU-09.pdf NCUA letter to credit unions], July 2004</ref> to [[e-mail privacy]]<ref name="opgp">[http://tools.ietf.org/html/2440 Open PGP Message Format] RFC at the [[IETF]]</ref> and [[SSH|secure remote access]]<ref name="ssh">[http://www.windowsecurity.com/articles/SSH.html SSH at windowsecurity.com] by Pawel Golen, July 2004</ref>.  Many other block ciphers have been designed and released, with considerable variation in quality; see [[:Category:Block ciphers|Category:Block ciphers]]<ref name="hac" /><ref name="schneierbook">[[Bruce Schneier]], ''Applied Cryptography'', 2nd edition, Wiley, 1996, ISBN 0-471-11709-9.</ref>.

Stream ciphers, in contrast to the 'block' type, create an arbitrarily long stream of key material, which is combined with the plaintext bit by bit or character by character, somewhat like the one-time pad.  In a stream cipher, the output stream is created based on an internal state which changes as the cipher operates. That state's change is controlled by the key, and, in some stream ciphers, by the plaintext stream as well. [[RC4]] is an example of a well-known stream cipher; see [[:Category:Stream ciphers|Category:Stream ciphers]]<ref name="hac" />.

[[Cryptographic hash functions]] (often called ''message digest functions'') do not use keys, but are a related and important class of cryptographic algorithms. They take input data (often an entire message), and output a short, fixed length [[hash function|hash]], and do so as a one-way function. For good ones, collisions (two plaintexts which produce the same hash) are extremely difficult to find.

[[Message authentication code]]s (MACs) are much like cryptographic hash functions, except that a secret key is used to authenticate the hash value<ref name="hac" /> on receipt.

====Public-key encryption====
In ''public key'' encryption, a user has their computer produce two different keys: one key is the “public” key used only for encryption, and the other key is the "private" key used only for decryption.  The public key can only be used to encrypt, and the user sends this public key to a stranger.  The stranger uses the public key to encrypt messages and send them back to the user, who then uses the private key to decrypt the received message.  ''Public key'' encrypion is also sometimes called ''asymmetric'' encryption.

Unlike private key encryption which assumes both sender and receiver already know the private key, public-key exchange allows you to securely issue a key to anyone so that person can then send you encrypted information.  Only you can decrypt the information; an intruder with the public key cannot read the encrypted message.

The keys used in "public key" systems are quite different from the string keys used for "private key" systems.  In "public key" systems, each key is a structure with eight fields.  The private key has all the fields populated (six are used for decrypting, and two for encrypting).  The public version is derived from the private key by copying only the two encrypt fields into a new key version and blanking out the six decrypt fields.

Public-key encryption is slower than private key encryption, and it cannot process large amounts of data. An example of a public-key encryption algorithm is RSA (which stands for Rivest, Shamir, and Adleman, its developers' last names).  RSA can encrypt a message of only 116 bytes (58 unicode chars).  The primary usage of public-key encryption is to securely pass a private key when first opening a channel across a network.  The private key is then installed (hidden), and after this initial setup, all further communication is done by private key encryption, which does not have the same message size limitation as public key encryption (and is also faster).

=====More details=====

Symmetric-key cryptosystems typically use the same key for encryption and decryption.  A significant disadvantage of symmetric ciphers is the [[key management]] necessary to use them securely.  Each distinct pair of communicating parties must share a different key. The number of keys required increases as the [[square (algebra)|square]] of the number of network members, which requires very complex key management schemes in large networks.  The difficulty of establishing a secret key between two communicating parties when a [[secure channel]] doesn't already exist between them also presents a [[chicken-and-egg problem]] which is a considerably practical obstacle for cryptography users in the real world.

In a groundbreaking 1976 paper, [[Whitfield Diffie]] and [[Martin Hellman]] proposed the notion of ''public-key'' (also, more generally, called ''asymmetric key'') cryptography in which two different but mathematically related keys are used: a ''public'' key  and a ''private'' key<ref>[[Whitfield Diffie]] and [[Martin Hellman]], "Multi-user cryptographic techniques" [Diffie and Hellman, AFIPS Proceedings 45, pp109-112, June 8, 1976].</ref>.  A [[public key cryptography]] system is constructed so that calculation of the private key is computationally infeasible from knowledge of the public key, even though they are necessarily related. Instead, both keys are generated secretly, as an interrelated pair<ref>[[Ralph Merkle]] was working on similar ideas at the time, and Hellman has suggested that the term used should be Diffie-Hellman-Merkle aysmmetric key cryptography.</ref>. The  historian [[David Kahn]] described public-key cryptography as "the most revolutionary new concept in the field since polyalphabetic substitution emerged in the Renaissance".<ref>David Kahn, "Cryptology Goes Public", 58 ''[[Foreign Affairs]]'' 141, 151 (fall 1979), p. 153.</ref>

In public-key cryptosystems, the public key may be freely distributed, while its paired private key must remain secret.  The ''public key'' is typically used for encryption, while the ''private'' or ''secret key'' is used for decryption.  Diffie and Hellman showed that public-key cryptography was possible by presenting the [[Diffie-Hellman]] key exchange protocol<ref name="dh2" />. In 1978, [[Ronald Rivest]], [[Adi Shamir]], and [[Len Adleman]] invented [[RSA]], another public-key system<ref>[[Ronald L. Rivest|R. Rivest]], [[Adi Shamir|A. Shamir]], [[Len Adleman|L. Adleman]]. [http://theory.lcs.mit.edu/~rivest/rsapaper.pdf A Method for Obtaining Digital Signatures and Public-Key Cryptosystems]. Communications of the ACM, Vol. 21 (2), pp.120&ndash;126. 1978. Previously released as an MIT "Technical Memo" in April 1977, and published in [[Martin Gardner]]'s ''[[Scientific American]]'' [[Mathematical Recreations]] column</ref>.  In 1997, it finally became publicly known that asymmetric cryptography had been invented by [[James H. Ellis]] at GCHQ, a [[United Kingdom|British]] intelligence organization, in the early 1970s, and that both the Diffie-Hellman and RSA algorithms had been previously developed (by [[Malcolm J. Williamson]] and [[Clifford Cocks]], respectively)<ref>[http://www.cesg.gov.uk/publications/media/nsecret/notense.pdf Clifford Cocks. A Note on 'Non-Secret Encryption', CESG Research Report, 20 November 1973].</ref>.

Diffie-Hellman and RSA, in addition to being the first publicly known examples of high quality public-key cryptosystems, have been among the most widely used. Others include the [[Cramer-Shoup cryptosystem]], [[ElGamal encryption]], and various [[Elliptic curve cryptography|elliptic curve techniques]]. See [[:Category:Asymmetric-key cryptosystems|Category:Asymmetric-key cryptosystems]].

In addition to encryption, public-key cryptography can be used to implement [[digital signature]] schemes.  A digital signature is somewhat like an ordinary [[signature]]; they have the characteristic that they are easy for a user to produce, but difficult for anyone else to [[forgery|forge]]. Digital signatures can also be permanently tied to the content of the message being signed; they cannot be 'moved' from one document to another, for any attempt will be detectable. In digital signature schemes, there are two algorithms: one for ''signing'', in which a secret key is used to process the message (or a hash of the message or both), and one for ''verification,'' in which the matching public key is used with the message to check the validity of the signature.  [[RSA]] and [[Digital Signature Algorithm|DSA]] are two of the most popular digital signature schemes.  Digital signatures are central to the operation of [[public key infrastructure]]s and to many network security schemes ([[Transport Layer Security|SSL/TLS]], many [[VPN]]s, etc)<ref name="schneierbook" />.

Public-key algorithms are most often based on the [[Computational complexity theory|computational complexity]] of "hard" problems, often from [[number theory]].   The hardness of RSA is related to the [[integer factorization]] problem, while Diffie-Hellman and DSA are related to the [[discrete logarithm]] problem.  More recently, ''[[elliptic curve cryptography]]'' has developed in which security is based on number theoretic problems involving [[elliptic curve]]s.  Because of the complexity of the underlying problems, most public-key algorithms involve operations such as [[modular arithmetic|modular]] multiplication and exponentiation, which are much more computationally expensive than the techniques used in most block ciphers, especially with typical key sizes. As a result, public-key cryptosystems are commonly "hybrid" systems, in which a fast symmetric-key encryption algorithm is used for the message itself, while the relevant symmetric key is sent with the message, but encrypted using a public-key algorithm.  Similarly, hybrid signature schemes are often used, in which a cryptographic hash function is computed, and only the resulting hash is digitally signed<ref name="hac" />.

==Cryptanalysis==
The goal of [[cryptanalysis]] is to find some weakness or insecurity in a cryptographic scheme, thus permitting its subversion. Cryptanalysis might be undertaken by a malicious attacker, attempting to subvert a system, or by the system's designer (or others) attempting to evaluate whether a system has vulnerabilities.  In modern practice, however, quality cryptographic algorithms and protocols have usually been carefully examined and many have been proved that establish practical security of the system (at least, under clear -- and hopefully reasonable -- assumptions).

It is a commonly held misconception that every encryption method can be broken. In connection with his WWII work at [[Bell Labs]], [[Claude Shannon]] proved that the [[one-time pad]] cipher is unbreakable, provided the key material is truly [[random numbers|random]], never reused, kept secret from all possible attackers, and of equal or greater length than the message<ref>"Shannon": [[Claude Shannon]] and Warren Weaver, "The Mathematical Theory of Communication", University of Illinois Press, 1963, ISBN 0-252-72548-4</ref>. That is, an enemy who intercepts an encrypted  message has provably no better chance of guessing the contents than an enemy who only knows the length
of the message.

Any cipher except a one-time pad can be broken with enough computational effort (by [[brute force attack]] if nothing else), but the amount of effort needed to break a cipher may be [[exponential time|exponentially]] dependent on the key size, as compared to the effort needed to ''use'' the cipher. In such cases, effective security can still be achieved if some conditions (e.g., key size) are such that the effort ('work factor' in Shannon's terms) is beyond the ability of any adversary.  

There are a wide variety of cryptanalytic attacks, and they can be classified in any of several ways. One distinction turns on what an attacker knows and can do. In a [[ciphertext-only attack]], the cryptanalyst has access only to the ciphertext (modern cryptosystems are usually effectively immune to ciphertext-only attacks). In a [[known-plaintext attack]], the cryptanalyst has access to a ciphertext and its corresponding plaintext (or to many such pairs).  In a [[chosen-plaintext attack]], the cryptanalyst may choose a plaintext and learn its corresponding ciphertext (perhaps many times); an example is the [[Gardening (cryptanalysis)|gardening]] used by [[Bletchley Park|the British]] during WWII.  Finally, in a [[chosen-ciphertext attack]], the cryptanalyst may ''choose'' ciphertexts and learn their corresponding plaintexts<ref name="hac" />. Also important, often overwhelmingly so, are mistakes (generally in the design or use of one of the [[protocol]]s involved; see [[Cryptanalysis of the Enigma]] for some historical examples of this).

Cryptanalysis of symmetric-key techniques typically involves looking for attacks against the block ciphers or stream ciphers that are more efficient than any attack that could be against a perfect cipher.  For example, a simple brute force attack against DES requires one known plaintext and 2<sup>55</sup> decryptions, trying approximately half of the possible keys, before chances are better than even the key will have been found.  But this may not be enough assurance; a [[linear cryptanalysis]] attack against DES requires 2<sup>43</sup> known plaintexts and approximately 2<sup>43</sup> DES operations<ref name="junod">Pascal Junod, [http://citeseer.ist.psu.edu/cache/papers/cs/22094/http:zSzzSzeprint.iacr.orgzSz2001zSz056.pdf/junod01complexity.pdf "On the Complexity of Matsui's Attack"], SAC 2001.</ref>. This is a considerable improvement on brute force attacks.

Public-key algorithms are based on the computational difficulty of various problems.  The most famous of these is [[integer factorization]] (the RSA cryptosystem is based on a problem related to factoring), but the [[discrete logarithm]] problem is also important.  Much public-key cryptanalysis concerns numerical algorithms for solving these computational problems, or some of them, efficiently.  For instance, the best algorithms for solving the [[elliptic curve cryptography|elliptic curve-based]] version of discrete logarithm are much more time-consuming than the best known algorithms for factoring, at least for problems of equivalent size. Thus, other things being equal, to achieve an equivalent strength of attack resistance, factoring-based encryption techniques must use larger keys than elliptic curve techniques.  For this reason, public-key cryptosystems based on elliptic curves have become popular since their invention in the mid-1990s.

While pure cryptanalysis uses weaknesses in the algorithms themselves, other attacks on cryptosystems are based on actual use of the algorithms in real devices, known as ''[[side-channel attack]]s''. If a cryptanalyst has access to, say, the amount of time the device took to encrypt a number of plaintexts or report an error in a password or PIN character, he may be able to use a [[timing attack]] to break a cipher that is otherwise resistant to analysis. An attacker might also study the pattern and length of messages to derive valuable information; this is known as [[traffic analysis]]<ref name="SWT">Dawn Song, David Wagner, and Xuqing Tian, [http://citeseer.ist.psu.edu/cache/papers/cs/22094/http:zSzzSzeprint.iacr.orgzSz2001zSz056.pdf/junod01complexity.pdf "Timing Analysis of Keystrokes and Timing Attacks on SSH"], In Tenth [[USENIX Security]] Symposium, 2001.</ref>, and can be quite useful to an alert adversary. And, of course, [[social engineering]], and other attacks against personnel who work with cryptosystems or the messages they handle (e.g., [[bribery]], [[extortion]], [[blackmail]], [[espionage]], ...) may be most productive attacks of all.

===Cryptographic primitives===
Much of the theoretical work in cryptography concerns [[cryptographic primitive|cryptographic ''primitives'']] &mdash; algorithms with basic cryptographic properties &mdash; and their relationship to other cryptographic problems.  For example, a [[one-way function]] is a [[function (mathematics)|function]] intended to be easy to compute but hard to invert. In a very general sense, for any cryptographic application to be secure (if based on such computational feasibility assumptions), one-way functions must exist.  However, if one-way functions exist, this implies that [[Complexity classes P and NP|P ≠ NP]]<ref name="goldreichbook" />.  Since the P versus NP problem is currently unsolved, we don't know if one-way functions exist.  If they do, however, we can build other cryptographic tools from them.  For instance, if one-way functions exist, then [[Cryptographically secure pseudorandom number generator|secure pseudorandom generators]] and secure pseudorandom functions exist<ref>J. Håstad, R. Impagliazzo, L.A. Levin, and M. Luby, [http://epubs.siam.org/SICOMP/volume-28/art_24470.html "A Pseudorandom Generator From Any One-Way Function"], SIAM J. Computing, vol. 28 num. 4, pp 1364–1396, 1999.</ref>.

Other cryptographic primitives include cipher algorithms themselves, [[one-way permutation]]s, [[trapdoor permutation]]s, etc.

===Cryptographic protocols===
In many cases, cryptographic techniques involve back and forth communication among two or more parties in space or across time (e.g., cryptographically protected [[backup]] data).  The term ''[[cryptographic protocol]]'' captures this general idea.  Cryptographic protocols have been developed for a wide range of problems, including relatively simple ones like [[interactive proof]]s<ref>László Babai. [http://portal.acm.org/citation.cfm?id=22192 "Trading group theory for randomness"]. ''Proceedings of the Seventeenth Annual Symposium on the Theory of Computing'', ACM, 1985.</ref>, [[secret sharing]]<ref>G. Blakley. "Safeguarding cryptographic keys."  In ''Proceedings of AFIPS 1979'', volume 48, pp. 313-317, June 1979.</ref><ref>A. Shamir. "How to share a secret."  In ''Communications of the ACM'', volume 22, pp. 612-613, ACM, 1979.</ref>, and [[zero-knowledge]]<ref>[[Shafi Goldwasser|S. Goldwasser]], [[Silvio Micali|S. Micali]], and [[Charles Rackoff|C. Rackoff]], "The Knowledge Complexity of Interactive Proof Systems", SIAM J. Computing, vol. 18, num. 1, pp. 186-208, 1989.</ref>, and much more complex ones like [[electronic cash]] and [[secure multiparty computation]]. 

When the security of a cryptographic system fails, it is rare that the vulnerabilty leading to the breach will have been in a quality cryptographic primitive. Instead, weaknesses are often mistakes in the protocol design (often due to inadequate design procedures or less than thoroughly informed designers), in the implementation (e.g., a [[software bug]]), in a failure of the assumptions on which the design was based (e.g., proper training of those who will be using the system), or some other human error.  Many cryptographic protocols have been designed and analyzed using ''ad hoc'' methods.  Methods for formally analyzing the security of protocols, based on techniques from [[mathematical logic]] (see for example [[BAN logic]]), and more recently from [[concrete security]] principles, have been the subject of research for the past few decades<ref>D. Dolev and A. Yao, [http://ieeexplore.ieee.org/xpl/abs_free.jsp?arNumber=1056650 "On the security of public key protocols"], ''IEEE transactions on information theory'', vol. 29 num. 2, pp. 198-208, IEEE, 1983.</ref><ref>M. Abadi and P. Rogaway, "Reconciling two views of cryptography (the computational soundness of formal encryption)." In ''IFIP International Conference on Theoretical Computer Science (IFIP TCS 2000)'', Springer-Verlag, 2000.</ref><ref>D. Song, "Athena, an automatic checker for security protocol analysis", In ''Proceedings of the 12th IEEE Computer Security Foundations Workshop (CSFW)'', IEEE, 1999.</ref>. Unfortunately, these tools are cumbersome and not widely used for complex designs.  

The study of how best to implement and integrate cryptography in applications is itself a distinct field, see: [[cryptographic engineering]] and [[security engineering]].

==Legal issues involving cryptography==
===Prohibitions===
Because of its potential to assist the malicious in their schemes, cryptography has long been of interest to intelligence gathering agencies and [[law enforcement]] agencies.  Because of its facilitation of [[privacy]], and the diminution of privacy attendant on its prohibition, cryptography is also of considerable interest to civil rights supporters. Accordingly, there has been a history of controversial legal issues surrounding cryptography, especially since the advent of inexpensive computers has made possible wide spread access to high quality cryptography.  

In some countries, even the domestic use of cryptography is, or has been, restricted.  Until 1999, [[France]] significantly restricted the use of cryptography domestically.  In [[People's Republic of China|China]], a license is still required to use cryptography. Many countries have tight restrictions on the use of cryptography. Among the more restrictive are laws in [[Belarus]], China, [[Kazakhstan]], [[Mongolia]], [[Pakistan]], [[Russia]], [[Singapore]], [[Tunisia]], [[Venezuela]], and [[Vietnam]]<ref name="cryptofaq">[http://www.rsasecurity.com/rsalabs/node.asp?id=2152 RSA Laboratories' Frequently Asked Questions About Today's Cryptography]</ref>.  

In the [[United States of America|United States]], cryptography is legal for domestic use, but there has been much conflict over legal issues related to cryptography.  One particularly important issue has been the [[export of cryptography]] and cryptographic software and hardware.  Because of the importance of cryptanalysis in [[World War II]] and an expectation that cryptography would continue to be important for national security, many western governments have, at some point, strictly regulated export of cryptography.  After World War II, it was illegal in the US to sell or distribute encryption technology overseas; in fact, encryption was classified as a [[munition]], like tanks and nuclear weapons<ref name="cyberlaw">[http://www.cyberlaw.com/cylw1095.html Cryptography & Speech] from Cyberlaw</ref>.  Until the advent of the [[personal computer]] and the [[Internet]], this was not especially problematic as good cryptography was indistinguishable from bad cryptography for nearly all users, and because most of the cryptographic techniques generally available were slow and error prone whether good or bad. However, as the Internet grew and computers became more widely available, high quality encryption techniques became well-known around the globe. As a result, export controls came to be understood to be an impediment to commerce and to research.

===Export Controls===
In the 1990s, several challenges were launched against US regulations for [[export of cryptography]]. [[Philip Zimmermann]]'s [[Pretty Good Privacy]] (PGP) encryption program, as well as its [[source code]], was released in the US, and found its way onto the Internet in June of 1991.  After a complaint by [[RSA Security]] (then called RSA Data Security, Inc., or RSADSI), Zimmermann was criminally investigated by the Customs Service and the [[Federal Bureau of Investigation|FBI]] for several years but no charges were filed<ref name="zim">[http://www.ieee-security.org/Cipher/Newsbriefs/1996/960214.zimmerman.html "Case Closed on Zimmermann PGP Investigation"], press note from the [[IEEE]].</ref><ref name="levybook">{{cite book|
  | last = Levy
  | first = Steven
  | authorlink = Steven Levy
  | title = "Crypto: How the Code Rebels Beat the Government &mdash; Saving Privacy in the Digital Age
  | publisher = [[Penguin Books]]
  | date = 2001
  | id = ISBN 0-14-024432-8
  | pages = 56
}}</ref>.  Also, [[Daniel Bernstein]], then a graduate student at [[UC Berkeley]], brought a lawsuit against the US government challenging aspects of those restrictions on [[1st Amendment|free speech]] grounds in the 1995 case [[Bernstein v. United States]] which ultimately resulted in a 1999 decision that printed source code for cryptographic algorithms and systems was protected as [[freedom of speech|free speech]] by the United States Constitution.<ref name="b v us">[http://www.epic.org/crypto/export_controls/bernstein_decision_9_cir.html Bernstein v USDOJ], 9th Circuit court of appeals decision.</ref>.

In 1996, thirty-nine countries signed the [[Wassenaar Arrangement]], an arms control treaty that deals with the export of arms and "dual-use" technologies such as cryptography. The treaty stipulated that the use of cryptography with short key-lengths (56-bit for symmetric encryption, 512-bit for RSA) would no longer be export-controlled<ref name="wa">[http://www.wassenaar.org/guidelines/index.html The Wassenaar Arrangement on Export Controls]</ref>. Cryptography exports from the US are now much less strictly regulated than in the past as a consequence of a major relaxation in 2000<ref name="cryptofaq" />; there are no longer many restrictions on key sizes in US-[[Export of cryptography|exported]] mass-market software.  In practice today, since the relaxation in US export restrictions, and because almost every [[personal computer]] connected to the [[Internet]], everywhere in the world, includes a US-sourced [[web browser]] such as [[Mozilla Firefox]] or [[Microsoft Internet Explorer]], almost every Internet user worldwide has strong cryptography (i.e., using long keys) in their browser's [[Transport Layer Security]] or [[SSL]] stack. The [[Mozilla Thunderbird]] and [[Microsoft Outlook]] [[E-mail client]] programs similarly can connect to [[IMAP]] or [[Post Office Protocol|POP]] servers via TLS, and can send and receive email encrypted with [[S/MIME]]. Many Internet users don't realize that their basic application software contains such extensive cryptography systems. These browsers and email programs are so ubiquitous that even governments whose intent is to regulate civilian use of cryptography generally don't find it practical to do much to control distribution or use of this quality of cryptography, so even when such laws are in force, actual enforcement is often lax.

===NSA involvement===
Another contentious issue connected to cryptography in the United States, is influence of the [[National Security Agency]] in high quality cipher development and policy. NSA was involved with the design of [[Data Encryption Standard|DES]] during its development at IBM and its consideration by the [[National Bureau of Standards]] as a possible Federal Standard for cryptography<ref name="cryptogram">[http://www.schneier.com/crypto-gram-0006.html#DES "The Data Encryption Standard (DES)"] from [[Bruce Schneier]]'s CryptoGram newsletter, June 15, 2000</ref>.  DES was designed to be secure against [[differential cryptanalysis]]<ref name="coppersmith-des">
{{cite journal
 | last = Coppersmith
 | first = D.
 | authorlink = 
 | coauthors = 
 | year = 1994
 | month = May
 | title = The Data Encryption Standard (DES) and its strength against attacks
 | journal = IBM Journal of Research and Development
 | volume = 38
 | issue = 3
 | pages = 243
 | url = http://www.research.ibm.com/journal/rd/383/coppersmith.pdf
 | format = PDF
 }}
</ref>, a powerful and general cryptanalytic technique known to NSA and IBM, that became publicly known only when it was rediscovered in the late 1980s. According to [[Steven Levy]], IBM discovered differential cryptanalysis<ref name="levy-dc">Levy, pg. 56</ref> and kept the technique secret at NSA's request. Another instance of NSA's involvement was the 1993 [[Clipper chip]] affair, an encryption microchip intended to be part of the [[Capstone (cryptography)|Capstone]] cryptography-control initiative. Clipper was widely criticized for two cryptographic reasons: the cipher algorithm was classified (the cipher, called [[Skipjack (cipher)|Skipjack]], was declassified in 1998 after the Clipper initiative lapsed), which led to concerns that NSA had deliberately made the cipher weak in order to assist its intelligence efforts. The whole initiative was also criticized based on its violation of [[Kerckhoffs' principle]], as the scheme included a special [[key escrow|escrow key]] held by the government for use by law enforcement, for example in wiretaps<ref name="levybook" />.

===Digital rights management===
Cryptography is central to [[digital rights management]] (DRM), a group of techniques for technologically controlling use of [[copyright]]ed material, being widely implemented and deployed at the behest of some copyright holders. In 1998, [[Bill Clinton]] signed the [[Digital Millennium Copyright Act]] (DMCA), which criminalized the production, dissemination, and use of certain cryptanalytic techniques and technology; specifically, those that could be used to circumvent DRM technological schemes<ref name="DMCA">[http://www.copyright.gov/legislation/dmca.pdf Digital Millennium Copyright Act]</ref>. This had a very serious potential impact on the cryptography research community since an argument can be made that virtually ''any'' cryptanalytic research violated, or might violate, the DMCA.  The [[Federal Bureau of Investigation|FBI]] has not enforced the DMCA as rigorously as had been feared by some, but the law, nonetheless, remains a controversial one. One well-respected cryptography researcher, [[Niels Ferguson]], has publicly stated that he will not release some research into an [[Intel Corporation|Intel]] security design for fear of prosecution under the DMCA, and both [[Alan Cox]] (longtime number 2 in Linux kernel development) and Professor [[Edward Felten]] (and some of his students at Princeton) have encountered problems related to the Act. [[Dmitry Sklyarov]] was arrested, and jailed for some months, for alleged violations of the DMCA which occurred in Russia, where the work for which he was arrested and charged was legal.


==History of cryptography and cryptanalysis==
{{Main|History of cryptography}}
The word ''cryptography'' is derived from [[Greek language|Greek]] κρυπτός ''kryptós'' "hidden," and γράφειν ''gráfein'' "to write".  Before the modern era, cryptography was concerned solely with message confidentiality (i.e. encryption) &mdash; conversion of [[information|messages]] from a comprehensible form into an incomprehensible one and back again at the other end, rendering it unreadable without secret knowledge (namely, the key). In recent decades, the field has expanded beyond confidentiality concerns to include techniques for [[authentication]], [[digital signature]]s, [[interactive proof]]s, and [[secure multiparty computation|secure computation]].

The earliest forms of secret writing required little more than pen and paper. The main classical cipher types  are [[transposition cipher]]s, which rearrange the order of letters in a message (e.g. 'help me' becomes 'ehpl em'); and [[substitution cipher]]s, which systematically replace letters or groups of letters with other letters or groups of letters (e.g. 'fly at once' becomes 'gmz bu podf' by replacing each letter with the one following it in the alphabet). Simple versions of either offered little confidentiality. An early and simple substitution cipher was the [[Caesar cipher]], in which each letter in the plaintext was replaced by a letter some fixed number of positions further down the alphabet. It was named after [[Julius Caesar]] who used the cipher with a shift of 3 in order to communicate with his generals during his various military campaigns. 

Encryption attempted to ensure [[secrecy]] in important communications, such as those of [[spy|spies]], military leaders, and [[diplomat]]s, but it also had religious applications.  For instance, early Christians used cryptography to obfuscate parts of their religious writings to avoid near certain persecution they would have faced had they been less obscured; famously, [[666 (number)|666]], the [[Number of the Beast]] from the [[Christian]] [[New Testament]] [[Book of Revelation]], is sometimes thought to be a ciphertext referring to the Roman Emperor [[Nero]], one of whose policies was persecution of Christians<ref name="bible comment">Eerdmans Commentary on the Bible, James D G Dunn, John W Rogerson, eds., Wm. B. Eerdmans Publishing, 2003, ISBN 0-8028-3711-5</ref>.  There is record of several, even earlier, Hebrew ciphers as well. Cryptography is also recommended in the [[Kama Sutra]] as a way for lovers to communicate without discovery<ref "kama">''Kama Sutra'', Sir Richard F. Burton, translator, Part I, Chapter III, 44th and 45th arts.</ref>.  [[Steganography]] (which is hiding a message so as to make its existence undetectable) was also first developed in ancient times. An early example, from [[Herodotus]], concealed a message - a tattoo on a slave's head - by regrown hair<ref name="kahnbook">[[David Kahn]], [[The Codebreakers]], 1967, ISBN 0-684-83130-9.</ref>.  More modern examples of steganography include the use of [[invisible ink]], [[microdot]]s, and [[digital watermark]]s to conceal information . 

Ciphertexts produced by classical ciphers reveal statistical information about the plaintext, which can be used to break them. After the Arab discovery of [[frequency analysis]] (around the year [[1000]]), nearly all such ciphers became more or less breakable by an informed attacker. Such classical ciphers still enjoy popularity today, though mostly as [[puzzle]]s (see [[cryptogram]]). Essentially all ciphers remained vulnerable to cryptanalysis using this technique until the invention of the [[polyalphabetic cipher]] by [[Leon Battista Alberti]] around the year [[1467]], in which different parts of the message (often each successive plaintext letter) are enciphered using a different key. In the polyalphabetic [[Vigenère cipher]], for instance, encryption uses a ''key word'', which controls letter enciphering depending on which letter of the key word is used. Despite this improvement, polyalphabetic ciphers of this type remained partially vulnerable to frequency analysis techniques<ref name="kahnbook" />.

Although frequency analysis is a powerful and general technique, encryption was still often effective in practice: many a would-be cryptanalyst was unaware of the technique. Breaking a message without frequency analysis essentially required knowledge of the cipher used, thus encouraging espionage, bribery, burglary, defection, etc. to discover it.  It was finally recognized in the 19th century that secrecy of a cipher's algorithm is not a sensible, nor practical, safeguard: in fact, any adequate cryptographic scheme (including ciphers) should still be secure even if the adversary knows the cipher itself. Secrecy of the key should be alone sufficient for confidentiality when it is attacked. This fundamental principle was first explicitly stated in 1883 by [[Auguste Kerckhoffs]] and is called [[Kerckhoffs' principle]]; alternatively and more bluntly, it was restated by [[Claude Shannon]] as ''Shannon's Maxim''.

Various physical devices and aids have been used to assist with ciphers. One of the earliest may have been the [[scytale]] of [[ancient Greece]], a rod supposedly used by the Spartans as an aid for a transposition cipher. In medieval times, other aids were invented such as the [[Grille (cryptography)|cipher grille]], also used for a kind of steganography. With the invention of polyalphabetic ciphers came more sophisticated aids such as Alberti's own [[cipher disk]], [[Johannes Trithemius]]' [[tabula recta]] and [[Thomas Jefferson]]'s cylinder (reinvented by [[Bazeries]] around 1900). Early in the 20th century, several mechanical encryption/decryption devices were invented, and many patented,  including [[rotor machine]]s &mdash; most famously the [[Enigma machine]] used by Germany in [[World War II]]. The ciphers implemented by the better of these designs brought about a substantial increase in cryptanalytic difficulty<ref>[[James Gannon]], ''Stealing Secrets, Telling Lies:  How [[Espionage|Spies]] and [[Cryptology|Codebreakers]] Helped Shape the [[Twentieth Century]]'', Washington, D.C., Brassey's, 2001, ISBN 1-57488-367-4.</ref>.

The development of digital computers and [[electronics]] after WWII made possible much more complex ciphers. Furthermore, computers allowed for the encryption of any kind of data that is represented by computers in binary unlike classical ciphers which only encrypted written text, dissolving the need for a linguistic approach to cryptanalysis. Many computer ciphers can be characterised by their operation on [[Binary numeral system|binary]] [[bit]]s (sometimes in groups or blocks), unlike classical and mechanical schemes, which generally manipulate traditional characters (i.e. letters and digits).  However, computers have also assisted cryptanalysis, which has compensated to some extent for increased cipher complexity. Nonetheless, good modern ciphers have stayed ahead of cryptanalysis: it is usually the case that use of a quality cipher is very efficient, while breaking it requires an effort many orders of magnitude larger, making cryptanalysis so inefficient and impractical as to be effectively impossible.

Extensive open academic research into cryptography is relatively recent &mdash; it began only in the mid-1970s with the public specification of DES (the [[Data Encryption Standard]]), the [[Diffie-Hellman]] paper,<ref name="dh2">[[Whitfield Diffie]] and [[Martin Hellman]], "[[New Directions in Cryptography]]", IEEE Transactions on Information Theory, vol. IT-22, Nov. 1976, pp: 644-654. ([http://citeseer.ist.psu.edu/rd/86197922%2C340126%2C1%2C0.25%2CDownload/http://citeseer.ist.psu.edu/cache/papers/cs/16749/http:zSzzSzwww.cs.rutgers.eduzSz%7EtdnguyenzSzclasseszSzcs671zSzpresentationszSzArvind-NEWDIRS.pdf/diffie76new.pdf pdf])</ref> and the public release of the [[RSA]] algorithm. Since then, cryptography has become a widely used tool in communications, computer networks, and computer security generally. The security of many modern cryptographic techniques is based on the difficulty of certain computational problems, such as the [[integer factorisation]] problem or the [[discrete logarithm]] problem.  In many cases, there are proofs that cryptographic techniques are secure ''if'' a certain computational problem cannot be solved efficiently<ref name="goldreichbook">[[Oded Goldreich]], ''Foundations of Cryptography, Volume 1: Basic Tools", Cambridge University Press, 2001, ISBN 0-521-79172-3</ref>. With one notable exception - the [[one-time pad]] - these contingent proofs are the best available for cryptographic algorithms and protocols. 

As well as being aware of cryptographic history, cryptographic algorithm and system designers must also carefully consider probable future developments in their designs. For instance, the continued improvements in computer processing power in increasing the scope of brute-force attacks must be taken into account when specifying [[key length]]s, and the potential effects of [[quantum computing]] are already being considered by good cryptographic system designers<ref name="hac">AJ Menezes, PC van Oorschot, and SA Vanstone, [http://cacr.math.uwaterloo.ca/hac/ Handbook of Applied Cryptography] ISBN 0-8493-8523-7.</ref>.

Essentially, prior to the early 20th century, cryptography was chiefly concerned with [[language|linguistic]] patterns.  Since then the emphasis has shifted, and cryptography now makes extensive use of mathematics, including aspects of [[information theory]], [[Computational complexity theory|computational complexity]], [[statistics]], [[combinatorics]], [[abstract algebra]], and [[number theory]].  Cryptography is also a branch of [[engineering]], but an unusual one as it deals with active, intelligent, and malevolent opposition (see [[cryptographic engineering]] and [[security engineering]]). There is also active research examining the relationship between cryptographic problems and [[quantum physics]] (see [[quantum cryptography]] and [[quantum computing]]).

==See also==

* [[Topics in cryptography|Short]] and [[List of cryptography topics|long]] lists of cryptography topics.
* [[List of cryptographers|Short]] and [[:Category:Cryptographers|long]] lists of cryptographers.
* Important [[Books on cryptography|books]], [[List of important publications in computer science#Cryptography|papers]], and [[List of open problems in computer science#Cryptography|open problems]] in cryptography.
* [[International Association for Cryptologic Research]].

==Further reading==
See [[Books on cryptography]] for a more detailed list.
* [[The Codebreakers]] by [[David Kahn]], a comprehensive history of classical (pre-WW2) cryptography.  The current edition has a brief addendum about WW2 and later.
* The Code Book by [[Simon Singh]], a clearly written anecdotal history of crypto, covering modern methods including public key.
* [[Crypto: How the Code Rebels Beat the Government Saving Privacy in the Digital Age]] by [[Steven Levy]], about the political and legal conflicts in the US about cryptography, such as the [[Clipper Chip]] controversy and the [[Bernstein v. United States]] lawsuit.
* [[Applied Cryptography]], 2nd edition, by [[Bruce Schneier]].  General reference book about crypto algorithms and protocols, aimed at implementers.
* [http://www.cacr.math.uwaterloo.ca/hac/ Handbook of Applied Cryptography] by A. J. Menezes, P. C. van Oorschot, and S. A. Vanstone (PDF download available), somewhat more mathematical than Schneier's book.
* ''Introduction to Modern Cryptography'' by [[Phillip Rogaway]] and [[Mihir Bellare]], a mathematical introduction to theoretical cryptography including reduction-based security proofs.   [http://www.cs.ucdavis.edu/~rogaway/classes/227/spring05/book/main.pdf PDF download].
* [http://www.rsasecurity.com/rsalabs/node.asp?id=2152 RSA Laboratories' Frequently Asked Questions About Today's Cryptography].
* ''Stealing Secrets, Telling Lies:  How [[Espionage|Spies]] and [[Cryptology|Codebreakers]] Helped Shape the [[Twentieth Century]]'', by [[James Gannon]].
* [http://www.mindspring.com/~schlafly/crypto/faq.htm sci.crypt mini-FAQ].
* [http://www.nsa.gov/kids/ NSA's CryptoKids].
* [[Cryptonomicon]] by [[Neal Stephenson]] (novel, WW2 [[Enigma machine|Enigma]] cryptanalysis figures into the story, though not always realistically).
* ''Alvin's Secret Code'' by [[Clifford B. Hicks]] (children's novel that introduces some basic cryptography and cryptanalysis).
* [http://java.sun.com/developer/technicalArticles/Security/Crypto/ Cryptography: The Ancient Art of Secret Messages] by [[Monica Pawlan]] - February 1998
* ''In Code: A Mathematical Journey'' by [[Sarah Flannery]] (with David Flannery). Popular account of Sarah's award-winning project on public-key cryptography, co-written with her father.
* ''Cryptography and Mathematics'' by [[Bernhard Esslinger]], 200 pages, part of the free open-source package [[Cryptool]], http://www.cryptool.com.

==References==
<div class="references-small">
<references />
</div>