Encryption – Exam-Corner

Many threats exist to system and network security. Examples include:
- Malware
- Viruses
- Spyware
- Hackers
- Denial of service attacks
- Social engineering
- SQL injection
Hackers are people who try to gain unlawful or unauthorised access to computers, networks and data by writing programs
They look for weaknesses in the system and use them to gain access
Hackers have various motives such as financial gain, a challenge or protests etc
Hackers sometimes target data in order to steal and use it, or block people from using the data by creating programs called ransomware
Hackers may also used packet sniffer to intercept and read data transmitted across the internet or a network
Hackers will often want to use people’s information and therefore it is beneficial to encrypt your data

What is encryption?

Encryption involves encoding data into a form that is meaningless using an algorithm
- An example could be turning the phrase “Computer Science” into “YekLKEZizFuFjHNCjHj3Md7qyTiGxLNNwPVFZtJU74I=”
Once encrypted, data can be decrypted which turns the encrypted data into data that can be understood again
Encryption doesn’t prevent hackers from hacking but makes the data hard if not impossible to understand unless they have matching decryption tools
There are two types of encryption: symmetric encryption and asymmetric encryption

Encryption relies on the use of a key. A key is a binary string of a certain length that when applied to an encryption algorithm can encrypt plaintext information and decrypt ciphertext
- Plaintext is the name for data before it is encrypted
- Ciphertext is the name for data after it is encrypted
Keys can vary in size and act like passwords, enabling people to protect information. A single incorrect digit in the key means the data cannot be decrypted correctly. Strong modern keys can be up to or over 1000 bits long!

In symmetric encryption both parties are given an identical secret key which can be used to encrypt or decrypt information
Key distribution problem: If a hacker gains access to the key then they can decrypt intercepted information
Methods exist to send the secret key to the receiver without sending it electronically:
- Both parties could verbally share the key in person
- Both parties may use standard postage mail to share the key (some businesses and banks may do this to ensure someone’s identity and authenticity)
- An algorithm may be used to calculate the key by sharing secret non-key information. An example is shown below

- Both parties A and B choose a number, for example A = 3, B = 2
- Both parties enter their own respective numbers into the following equations: 7^A MOD 11 or 7^B MOD 11. ^ is another way of writing “to the power of”
  - 7^3 MOD 11 = 2, 7^2 MOD 11 = 5
- Both parties swap their respective answers. A receives 5 and B receives 2. These answers replace the initial 7 number and the calculations are performed again
- Both parties enter their new number into the following equations: 5^3 MOD 11 or 2^2 MOD 11
  - 5^3 MOD 11 = 4, 2^2 MOD 11 = 4
- The answer should match for both parties and this becomes the encryption and decryption key value
Once the key is generated, it can be applied to the plaintext in the algorithm that then produces the ciphertext which is sent to the receiver
The receiver gets a copy of the ciphertext and the key and applies the encryption algorithm. The algorithm then produces the original plaintext for the receiver

In asymmetric encryption also known as public key encryption, two keys are used:
- Public key: a key known to everyone
- Private key: a key known only to the receiver
Both keys are needed to encrypt and decrypt information
Asymmetric encryption works as follows:
- Person A uses a public key to encrypt their message
- Person A sends their message over the network or internet
- Person B decrypts the messae using their secret private key
Asymmetric encryption works such that only one private key can be used to decrypt the message and it is not sent over the internet like a symmetric key
Keys can be very large, for example over 1000 bits. To get the correct key a hacker would have to calculate almost every possible combination. To illustrate, a key with only 100 bits would generate 1,267,650,600,228,229,401,496,703,205,376 different combinations

Encryption keys can be created manually, randomly or via an algorithm
Strong encryption keys are created using a hashing algorithm
A hashing algorithm is a non-reversible mathematical algorithm that converts a given input into an output. Once the output has been generated it is unable to be converted back to the original input
Encryption keys are created by supplying a message or key to the hashing algorithm which turns it into a string of characters usually shown in hexadecimal
SHA-2 is an example of a hashing algorithm that creates hashed keys of 244, 256, 384 or 512 bit length
- If the text string “Computer Science” is run through the SHA-2 algorithm, it would return a 512 bit key in hexadecimal as:
- “B6e175f5fc647b1a9ce17019594ce55b58e8fd03e3c584ee384121c8b4c7753d”
The hashed encryption key can then be sent symmetrically or kept secret as part of an asymmetric private key. Both sender and receiver need a copy of the key to decrypt information regardless of using symmetric or asymmetric encryption

In symmetric encryption, the key must be sent with the message to the receiver. If a hacker intercepts the key they can read the message
In asymmetric encryption, the public key is available to everyone and would not be useful to a hacker. The hacker must guess the private key in order to read the message
Hashing algorithms are many-to-one. This means that many input values, messages or keys can produce the same hash key output
A hashed encryption key means the hacker must first unhash the key before it is useful
As hashing algorithms are non-reversible this is extremely difficult
With SHA-2 for example, a hacker who wants to find the symmetric or asymmetric private key must calculate over 1.3×10^154 combinations; that is 13 with 153 0’s after it. With the computing power available today, this is virtually if not actually impossible