📑 Contents
★

Chapter 17: Security

Encryption, Encryption Protocols & Digital Certificates

9618 Computer Science

📚 Learning Objectives
📖 Prior Knowledge Required
🌟 Did You Know?

When data is transmitted over any public network, there is a risk of it being intercepted by hackers (eavesdroppers). Encryption helps to minimise this risk by altering data into a form that is unreadable by anybody for whom the data is not intended. It cannot prevent data being intercepted, but it stops it from making any sense to eavesdroppers!

1. How Encryption Works

Encryption is a process that scrambles readable text so it can only be read by the person who has the secret code, or decryption key. It helps provide data security for sensitive information.

📖 What is Encryption?
PLAIN TEXT "Hello World" + Key ENCRYPTION ALGORITHM (Mathematical Transformation) CIPHER TEXT "Xk3@pQ9#" Network Transmission The Encryption Process

1.1 Four Security Concerns

There are four main security concerns when data is transmitted:

Security Concern Description Achieved By
Confidentiality Only the intended recipient should be able to read or decipher the data Encryption, Public/Private keys
Authenticity Need to identify who sent data and verify that the source is legitimate Digital signatures
Integrity Data should reach its destination without any changes Digital signature / Message digest
Non-Repudiation Neither sender nor recipient should be able to deny they were part of the transmission Digital certificates
💡 Exam Tip

Remember CAIN: Confidentiality, Authenticity, Integrity, Non-repudiation. These are the four pillars of data transmission security!

2. Plaintext and Ciphertext

Cryptography is the process of converting between readable text, called plaintext, and an unreadable form, called ciphertext.

📝 The Encryption/Decryption Process
  1. Original data being sent is known as plaintext
  2. Sender converts plaintext message to ciphertext using an encryption algorithm and key
  3. The ciphertext is transmitted to the receiver over the network
  4. When transmission is received, receiver converts ciphertext back to plaintext using a decryption algorithm and key
📖 Key Definitions
Plaintext to Ciphertext Conversion SENDER Plaintext "Secret Message" Key Network Internet RECEIVER Xk3@pQ9# Lm$7nB2! Yz5*wE8& Hj4@tR1% Ciphertext "Xk3@pQ9#..." Key ENCRYPT DECRYPT
💡 Exam Tip

Remember: Plaintext = Human readable, Ciphertext = Scrambled/encrypted. The key is what makes the transformation possible!

3. Symmetric Encryption

Symmetric encryption uses a single secret key to encrypt and decrypt data. The same key is used for both processes.

📖 Key Characteristics of Symmetric Encryption
Symmetric Encryption - Same Key for Both Operations SENDER Encrypts with Key KEY SAME KEY RECEIVER Decrypts with Key Cipher Text ⚠️ KEY DISTRIBUTION PROBLEM How to securely share the key with the receiver?

3.1 The Key Distribution Problem

⚠️ Key Distribution Problem

One major issue with symmetric encryption is that both sender and recipient need to use the same secret key. This is a security risk, since the sender has to supply the key to the recipient. This key could be intercepted during transmission.

Advantages Disadvantages
Fast and efficient for bulk data Key distribution is problematic
Less computational overhead If key is compromised, all data is vulnerable
Simple to implement Not suitable for one-to-many communication
Same person can encrypt and decrypt Requires secure channel to share key

4. Asymmetric Encryption

Asymmetric encryption uses two keys - a public key for encryption and a private key for decryption. This solves the key distribution problem.

📖 Key Characteristics of Asymmetric Encryption
Asymmetric Encryption - Two Different Keys SENDER (Tom) Plaintext Message PUBLIC KEY (Meera's) Encrypt Cipher Text RECEIVER (Meera) Plaintext Received PRIVATE KEY (Meera's) Decrypt ✓ Key Pair Created Together Mathematically linked but cannot derive one from the other

4.1 Public vs Private Keys

Feature Public Key Private Key
Availability Known to everyone, widely distributed Only known to owner, kept secret
Primary Use Encrypt data Decrypt data
Distribution Shared via digital certificates Never shared with anyone
For Signatures Verifies digital signature Creates digital signature
💡 Exam Tip

Remember: Public key = Lock (encrypt), Private key = Key (decrypt). You share your public key with everyone so they can send you encrypted messages, but only YOU can decrypt them with your private key!

5. Choosing Encryption Type

Symmetric encryption is fast but has key-sharing issues; asymmetric is slower but solves these issues. The choice depends on whether speed or security is more critical.

Encryption Type Best Used For Reasons
Symmetric Large files, databases, backups Fast and efficient for bulk data; same person encrypts and decrypts
Asymmetric Confidential communications, passwords, bank details Solves key distribution problem; highly secure for sensitive data

6. Quantum Cryptography

Quantum cryptography uses principles of quantum mechanics to secure communication channels. Unlike classical cryptography, it leverages quantum particles like photons to achieve secure communication.

📖 Purpose of Quantum Cryptography

6.1 Quantum Key Distribution (QKD)

📝 How QKD Works
  1. Sender uses a light source to generate photons
  2. Photons are sent through polarizers giving one of four possible polarisations:
  3. • Vertical polarisation = 1 bit
  4. • Horizontal polarisation = 0 bit
  5. • 45° right polarisation = 1 bit (diagonal)
  6. • 45° left polarisation = 0 bit
  7. Polarised photons travel along fibre optic cable
  8. At destination, beam splitters and photon detectors read the values
  9. Process repeated until encryption key transmitted
  10. If intercepted, photons are destroyed - key compromise detected!
Quantum Key Distribution (QKD) Light Source Polarizer ↕ ↕ ↗ ↙ Photons in Fibre Optic Beam Splitter X or Y ⚠️ Eavesdropping destroys photons!
Benefits Drawbacks
Unbreakable key transmission (quantum physics) Expensive - requires specialised hardware
Eavesdropper detection - interception changes quantum state Short distance limits (~250km)
Perfect forward secrecy - keys used once then discarded Slow transmission speed
Not vulnerable to quantum computers Technology still evolving, not standardised
💡 Exam Tip

Quantum cryptography secures the KEY EXCHANGE, not the message itself! It uses quantum mechanics to safely transmit encryption keys. Remember: if someone tries to intercept, the photons are destroyed and the intrusion is detected!

7. SSL/TLS Protocols

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols designed to provide communications security over a network. They encrypt data sent over the internet.

📖 What is SSL?
📖 What is TLS?
Feature SSL TLS
Security Level Older, less secure Modern, more secure
Extensibility Cannot add new authentication methods Can extend with new methods
Performance Slower (no session caching) Faster (uses session caching)
Architecture Monolithic design Separates handshake from record protocol

7.1 How SSL/TLS Works

📝 SSL/TLS Handshake Process
  1. Browser Request: Browser sends request to server asking it to identify itself
  2. Server Response: Server sends SSL certificate and its public key to browser
  3. Certificate Verification: Browser checks certificate against trusted Certificate Authorities (CAs)
  4. Trust Established: If trusted, browser creates a symmetric session key
  5. Key Encryption: Session key encrypted with server's public key, sent to server
  6. Server Decrypts: Server uses its private key to decrypt session key
  7. Secure Channel: All subsequent data encrypted with symmetric session key
SSL/TLS Handshake Process Browser (Client) Server (Website) 1. Identify yourself 2. SSL Certificate + Public Key 3. Verify with CA 4. Encrypted Session Key 5. Decrypt with Private Key 6. ✓ Secure Encrypted Channel
💡 Exam Tip

TLS has replaced SSL - but both are encryption protocols used with digital certificates. Always mention digital certificates when explaining how websites create secure connections!

8. SSL/TLS Applications

SSL/TLS protocols are used in many situations where secure data transmission is required:

Application Description
Online Banking All financial transactions require encryption
Online Shopping Protecting payment card details and personal information
Email Sending and receiving secure emails
Cloud Storage Secure file upload/download
VPNs Virtual Private Networks for secure remote access
VoIP Voice over IP for video and audio chatting
Social Networks Protecting user data and communications
Intranets/Extranets Secure internal company communications

8.1 Disadvantages of SSL

❌ Disadvantages of Using SSL
🌟 Did You Know?

The symmetric session key created during SSL/TLS handshake is used only for that particular session. This ensures all communication remains secure and private. After the session ends, the key is discarded!

How to Identify Secure Websites https:// www.secure-website.com 🔒 This connection is secure Certificate Valid | Encrypted Connection ✓ HTTPS Protocol ✓ Padlock Icon ✓ Valid Certificate

9. Digital Signatures

Digital signatures are a way of validating the authenticity of digital documents and identifying the sender. A signature is authentic when you know who created the document and that it has not been altered.

📖 Key Concepts

9.1 Creating a Digital Signature

📝 Steps to Create a Digital Signature

At Sender End:

  1. Sender uses a hash function on the message to create a message digest
  2. Sender encrypts the digest with their private key
  3. This encrypted digest is the digital signature
  4. Message is transmitted as plaintext along with digital signature
Creating a Digital Signature Original Message Hash HASH Function Message Digest Private Encrypt with Key DIGITAL SIGNATURE Message sent as plaintext

9.2 Verifying a Digital Signature

📝 Steps to Verify a Digital Signature

At Receiver End:

  1. Receiver uses same hash function on received message to create digest
  2. Receiver decrypts digital signature using sender's public key (from digital certificate)
  3. This produces the original message digest
  4. If both digests match, message is authentic and unaltered
❌ Limitation of Digital Signatures

Public key could be forged by a third party so recipient is not sure that message is from legitimate source. This is why we need Digital Certificates from trusted Certificate Authorities!

10. Digital Certificates

A digital certificate is an electronic document used to prove the online identity of a website or individual. It is issued by a trusted third party called a Certificate Authority (CA).

📖 What Does a Digital Certificate Contain?

10.1 How to Obtain a Digital Certificate

📝 Process of Obtaining a Digital Certificate
  1. Person A starts application on CA website
  2. Public key and associated private key generated on A's computer
  3. Person A submits application to CA containing public key and personal information
  4. Data encrypted with CA's public key before submission
  5. CA confirms identity of person A and decrypts with CA's private key
  6. CA creates digital certificate containing A's public key and data
  7. CA signs certificate with CA's private key
  8. Digital certificate issued to person A
Digital Certificate Structure DIGITAL CERTIFICATE Version: 3 Serial No: 0A:3F:2B:7E... Issued By: Certificate Authority (CA) Subject: John Smith / Company Name Valid: 01/01/2025 to 31/12/2025 PUBLIC KEY (For encryption) CA SIGNATURE (Proof of authenticity) Hash: SHA-256

10.2 Digital Certificate vs Digital Signature

Digital Certificate Digital Signature
Obtained from Certificate Authority (CA) Created from a message using hash function
Provides authentication of owner Authenticates individual messages
Remains unchanged while valid New signature created for every message
Contains public key and extra information Uses private key to create signature
🧠 Memory Trick

Certificate = ID Card (proves who you are, stays the same)

Signature = Signature (signs each document, unique to each message)

11. Key Takeaways

📌 Summary Points

Encryption Basics

Keys

Protocols & Certificates

Quantum Cryptography

Complete Security Flow Summary SENDER Has Private Key Encrypt with Public Key Ciphertext over Network Decrypt with Private Key RECEIVER Has Private Key Certificate Authority Public Key Public Key Issues Certificates

12. Exam-Style Questions

1. Encryption is used to alter data into a form that makes it meaningless if intercepted. Describe the purpose of asymmetric key cryptography. [4 marks]

Answer:

  • To provide better security by using two different keys (a public key and a private key)
  • One key is used to encrypt the message
  • The matching key is used to decrypt the message
  • Solves the key distribution problem of symmetric encryption

Additional points for deeper understanding:

  • Public key can be freely distributed; private key kept secret
  • Enables secure communication without prior key exchange
2. Explain the differences between symmetric and asymmetric encryption. Include their advantages and disadvantages. [6 marks]

Answer:

  • Symmetric: Uses one key for both encryption and decryption
  • Asymmetric: Uses two keys (public for encryption, private for decryption)
  • Symmetric is faster and more efficient for large data
  • Asymmetric solves the key distribution problem
  • Symmetric has security risk during key exchange
  • Asymmetric is slower but provides better security for sensitive data

Additional points:

  • Symmetric best for: large files, databases, backups
  • Asymmetric best for: passwords, bank details, confidential communications
3. Describe the purpose of quantum cryptography and explain one benefit and one drawback. [5 marks]

Answer:

  • Purpose: To produce a virtually unbreakable encryption system using quantum mechanics
  • Uses Quantum Key Distribution (QKD) with photons to securely share keys
  • Benefit: Eavesdropping detection - any interception changes quantum state
  • Benefit: Not vulnerable to quantum computers
  • Drawback: Expensive - requires specialised hardware and fibre optic cables

Additional points:

  • Drawback: Limited range (~250km)
  • Drawback: Slow transmission speed
  • Drawback: Technology still evolving, not standardised
4. Explain how SSL/TLS provides secure communication between a web browser and server. [6 marks]

Answer:

  • Browser requests server identification
  • Server sends SSL certificate containing its public key
  • Browser verifies certificate against trusted Certificate Authorities (CAs)
  • If trusted, browser creates a symmetric session key
  • Session key encrypted with server's public key and sent to server
  • Server decrypts session key with its private key
  • All subsequent data encrypted with symmetric session key
5. Describe how a digital signature is created and verified. [6 marks]

Creation (Sender):

  • Sender applies hash function to message to create message digest
  • Digest encrypted with sender's private key
  • This encrypted digest is the digital signature
  • Message sent as plaintext along with digital signature

Verification (Receiver):

  • Receiver applies same hash function to received message
  • Decrypts signature with sender's public key to get original digest
  • If digests match, message is authentic and unaltered
6. Explain the purpose of a digital certificate and describe how it is obtained. [5 marks]

Purpose:

  • Proves online identity of website or individual
  • Confirms that a public key belongs to a specific person/organisation
  • Issued by trusted Certificate Authority (CA)

Obtaining Process:

  • Applicant generates key pair (public and private)
  • Sends public key and identity information to CA
  • CA verifies identity
  • CA creates certificate and signs with CA's private key
  • Certificate issued to applicant

12. Exam-Style Questions (Continued)

7. Describe the four main security concerns when data is transmitted over a network. [8 marks]

Answer:

  • Confidentiality: Only intended recipient can read or decrypt the data; achieved through encryption and public/private keys
  • Authenticity: Need to identify who sent data and verify source is legitimate; achieved through digital signatures
  • Integrity: Data reaches destination without any changes; achieved through digital signatures and message digests
  • Non-Repudiation: Neither sender nor recipient can deny being part of transmission; achieved through digital certificates

Additional points:

  • Remember: CAIN - Confidentiality, Authenticity, Integrity, Non-repudiation
  • Each concern has specific technologies to address it
8. Explain the difference between a public key and a private key in asymmetric encryption. [4 marks]

Answer:

  • Public Key: Known to everyone; used to encrypt data or verify digital signatures
  • Private Key: Known only to owner; used to decrypt data or create digital signatures
  • Public key can be freely distributed via digital certificate
  • Private key must never be shared - compromise means all data vulnerable

Additional points:

  • Keys are mathematically linked but cannot derive one from the other
  • Both created at same time as a matching pair
9. A company wants to implement secure communication between its employees. Compare the use of symmetric and asymmetric encryption for this purpose. [6 marks]

Symmetric Encryption:

  • Fast and efficient for large amounts of data
  • But: Key distribution problem - how to share keys securely?
  • For n employees, need n(n-1)/2 unique keys for pairwise communication

Asymmetric Encryption:

  • Solves key distribution - each person only needs their own key pair
  • Only n key pairs needed for n employees
  • But: Slower for large data transfers

Recommendation:

  • Use asymmetric to exchange symmetric session keys
  • Then use symmetric for actual data transfer (hybrid approach)
  • This is how SSL/TLS works in practice
10. Explain the role of a Certificate Authority (CA) in the SSL/TLS handshake process. [5 marks]

Answer:

  • CA acts as a trusted third party between browser and server
  • CA verifies identity of website/organisation before issuing certificate
  • CA digitally signs the certificate with its private key
  • Browser has built-in list of trusted CAs and their public keys
  • Browser uses CA's public key to verify the certificate's authenticity
  • If certificate not from trusted CA, browser warns user or blocks connection

Additional points:

  • CAs maintain Certificate Revocation Lists (CRLs) for revoked certificates
  • Examples of CAs: DigiCert, Let's Encrypt, Comodo, GlobalSign
11. Describe the contents of a digital certificate. [6 marks]

Answer:

  • Version number of the certificate
  • Serial number - unique identifier for the certificate
  • Issuer name - the CA that issued the certificate
  • Subject name - identity of certificate owner
  • Public key of the subject
  • Validity period - start and expiry dates

Additional points:

  • Hash algorithm used for the certificate
  • CA's digital signature
  • Certificate extensions and constraints
12. Explain why quantum cryptography is considered more secure than classical encryption methods. [4 marks]

Answer:

  • Based on laws of physics rather than mathematical complexity
  • Any attempt to intercept photons destroys them - eavesdropping is immediately detected
  • Not vulnerable to advances in computing (including quantum computers)
  • Provides perfect forward secrecy - keys used once then discarded

Additional points:

  • Classical encryption could be broken by future quantum computers
  • QKD guarantees detection of any interception attempt

13. Glossary

Asymmetric Encryption: Encryption method using two different keys (public and private) for encryption and decryption.
Certificate Authority (CA): A trusted third party that issues digital certificates and verifies identities.
Cipher Text: Encrypted data that has been transformed from plaintext; unreadable without decryption.
Confidentiality: Ensuring only the intended recipient can read or decrypt data.
Decryption: The process of converting ciphertext back to plaintext using a key.
Digital Certificate: An electronic document that proves the identity of a person or organisation and contains a public key.
Digital Signature: A cryptographic value created by encrypting a message digest with the sender's private key; proves authenticity and integrity.
Encryption: The process of converting plaintext to ciphertext using an algorithm and key.
Hash Function: A one-way algorithm that produces a fixed-length output (hash) from any input; cannot be reversed.
Integrity: Ensuring data reaches its destination without any changes or tampering.
Key Distribution Problem: The challenge of securely sharing a secret key in symmetric encryption.
Message Digest: The output of a hash function applied to a message; a fixed-length summary of the original message.
Non-Repudiation: Neither sender nor recipient can deny being part of a data transmission.
Plaintext: Original, unencrypted data that humans can understand.
Private Key: A secret key known only to its owner; used to decrypt data or create digital signatures.
Public Key: A key that is freely distributed; used to encrypt data or verify digital signatures.
Quantum Cryptography: Encryption method using quantum mechanics principles, particularly photons, to secure key exchange.
Quantum Key Distribution (QKD): A method of securely distributing encryption keys using quantum particles.
SSL (Secure Sockets Layer): A security protocol for encrypting data transmitted over the internet.
Symmetric Encryption: Encryption method using the same key for both encryption and decryption.
TLS (Transport Layer Security): The modern, more secure successor to SSL for encrypting internet communications.

14. Exam Success Tips (Part 1)

💡 Remember CAIN
💡 Symmetric vs Asymmetric - Key Differences
💡 Public vs Private Key Roles
💡 Digital Signature Process
💡 SSL/TLS Handshake Summary

14. Exam Success Tips (Part 2)

🧠 Memory Tricks
❌ Common Mistakes to Avoid
⚠️ Key Points for Exam Questions
🌟 Quick Reference Table
Topic Key Point
Symmetric One key, fast, key distribution problem
Asymmetric Two keys (public/private), slower, secure
Digital Signature Hash + encrypt with private key
Digital Certificate Issued by CA, proves identity, contains public key
SSL/TLS Secure HTTPS, uses certificates, session keys
Quantum Crypto QKD, photons, detects eavesdropping
📌 Final Exam Reminders
9618 Computer Science
©2025 All Rights Reserved. Shyam Subrahmanya.