Teach: Technologies Supporting Information Security

Technologies Supporting Information Security

Because data on the Internet passes through many devices, there is a risk of eavesdropping and tampering. Even so, we can use online shopping and online banking with confidence because cryptographic technology protects communications. In this lesson, we will learn the core technologies of symmetric-key cryptography, public-key cryptography, and digital signatures.

The 3 Elements of Information Security

The goals of information security are organized into three elements: ①Confidentiality (only authorized people can access information), ②Integrity (information is accurate and has not been tampered with), and ③Availability (information can be used whenever it is needed). Encryption mainly supports confidentiality, while digital signatures support integrity.

Symmetric-Key Cryptography

Symmetric-key cryptography is a method that uses the same key for encryption and decryption (representative example: AES). Although it has the advantage of being fast, it has a key distribution problem: how to deliver the key safely to the communication partner. If the key is sent directly over the network, it may be stolen. In addition, when n people communicate secretly with one another, as many as n(n−1)÷2 keys are needed, making key management difficult as the number of partners increases.

Public-Key Cryptography

Public-key cryptography (representative example: RSA) uses a pair of a public key and a private key. Data encrypted with a public key can be decrypted only with the corresponding private key. The receiver makes the public key available to everyone, and the sender encrypts the data with the receiver's public key before sending it. Because only the receiver who has the private key can decrypt the data, it is no longer necessary to secretly exchange the key in advance, solving the key distribution problem. However, its processing is slower than that of symmetric-key cryptography.

Example Public-key cryptography can be compared to a "padlock." The receiver distributes an open padlock (the public key) around the world. The sender puts a message in a box, firmly closes the padlock, and sends it. Only the receiver who has the key (the private key) can open a lock once it has been closed. No matter how widely the lock (the public key) is distributed, its contents remain safe as long as the key for opening it remains secret.

In actual Web communications (the padlock mark for HTTPS), a hybrid method (SSL/TLS) is used: public-key cryptography first transfers a symmetric key safely, and the large amount of data afterward is exchanged using fast symmetric-key cryptography.

Digital Signatures and Digital Certificates

Using the mechanism of public-key cryptography in the opposite direction makes digital signatures possible. The sender signs using their own private key (encrypting a hash value created from the data), and the receiver verifies it using the sender's public key. If verification succeeds, it can be confirmed that ① the signature was created by the person who owns the private key (prevention of impersonation), and ② the content has not been changed during transmission (detection of tampering). In addition, a system in which a third-party organization called a certificate authority (CA) guarantees "whether the public key really belongs to that person" is called a digital certificate, and it forms the foundation of HTTPS security.

Key Points
  • The 3 elements of security are confidentiality, integrity, and availability.
  • Symmetric-key cryptography: encryption and decryption use the same key. It is fast but has a key distribution problem.
  • Public-key cryptography: encrypt with the receiver's public key and decrypt with the receiver's private key. It solves the key distribution problem.
  • SSL/TLS (HTTPS) is a hybrid method that combines both methods.
  • Digital signatures use "the private key for signing and the public key for verification." They can prevent impersonation and detect tampering.

Practice Questions

  1. If 10 people communicate secretly with one another using symmetric-key cryptography, how many keys are needed in total?
  2. When Person A sends a secret message to Person B using public-key cryptography, whose key and which key does Person A use for encryption?
  3. State two things that can be confirmed using a digital signature.

Answers and Explanations

  1. Answer: 45 keys
    Explanation: n people need n(n−1)÷2 keys. 10×9÷2＝45 keys. With public-key cryptography, each person only needs to have a key pair, so 10 pairs are enough, making management much easier.
  2. Answer: Person B's (the receiver's) public key
    Explanation: If the message is encrypted with B's public key, only B, who has the corresponding private key, can decrypt it. Note that the "other person's public key," not one's own key, is used.
  3. Answer: ① That the sender is the actual person (there is no impersonation), ② that the content has not been tampered with during transmission
    Explanation: Because a signature can be created only with the sender's private key, the sender's identity can be confirmed. When the hash values match during verification, integrity can also be confirmed.

Information (Information I): related lessons