Introduction to Cryptography in Cybersecurity

Cryptography is the science of securing information through mathematical techniques that make data unreadable to unauthorised parties, verifiable in origin, and detectable when altered. It is the foundational technology upon which virtually every modern information security control depends — from HTTPS web connections and encrypted email to digital signatures, VPNs, password hashing, and hardware security modules. Without cryptography, the concepts of Confidentiality, Integrity, and Availability as meaningful security guarantees would be impossible to achieve at scale across untrusted networks.

The relationship between cryptography and the CIA Triad is direct and architectural. Encryption algorithms protect Confidentiality by transforming plaintext into ciphertext that cannot be read without the correct key. Hash functions and digital signatures protect Integrity by enabling detection of any unauthorised modification to data or code. Availability is protected by cryptographic authentication protocols that prevent denial-of-service attacks based on credential theft and ensure that only legitimate users and systems can access critical services.

Cryptography and the CIA Triad

Fundamental Cryptographic Goals

Every cryptographic system is designed to achieve one or more of the following security properties. Understanding which properties a given algorithm provides — and which it deliberately does not address — is essential for selecting the correct cryptographic primitive for a given security requirement.

• ConfidentialityOnly authorised parties can read the protected information. Achieved through encryption algorithms that transform plaintext into computationally irreversible ciphertext without the key.
• IntegrityAny modification to protected data is detectable. Achieved through hash functions, MACs, and digital signatures that produce verification values dependent on the exact content.
• AuthenticationThe claimed identity of a party or the origin of a message can be verified. Achieved through digital signatures, MACs, and cryptographic challenge-response protocols.
• Non-RepudiationA party cannot falsely deny having performed an action. Achieved through digital signatures with asymmetric key pairs where only the signer possesses the private key.
• Forward SecrecyCompromise of long-term keys does not compromise past session keys. Achieved through ephemeral Diffie-Hellman key exchange (ECDHE) that generates unique session keys never stored persistently.
• Key ExchangeTwo parties can establish a shared secret over an insecure channel without prior shared secrets. Achieved through Diffie-Hellman and its elliptic-curve variant (ECDH).

Symmetric Cryptography

Symmetric cryptography uses the same key for both encryption and decryption. It is computationally efficient, making it suitable for encrypting large volumes of data. The fundamental challenge of symmetric cryptography is key distribution — both parties must share the secret key through a secure channel before encrypted communication can begin. In practice, symmetric encryption is used for bulk data encryption, while asymmetric cryptography handles key exchange and authentication.

Advanced Encryption Standard (AES)

AES (Advanced Encryption Standard), standardised by NIST in 2001, is the dominant symmetric encryption algorithm in modern cryptographic deployments. It replaced DES after public key sizes became insufficient for security. AES is a block cipher operating on 128-bit blocks with key sizes of 128, 192, or 256 bits, and is implemented in hardware acceleration on all modern processors.

Stream Ciphers and Legacy Symmetric Algorithms

Asymmetric Cryptography and Public Key Systems

Asymmetric cryptography (public-key cryptography) uses mathematically related key pairs: a public key that can be freely distributed and a private key that must remain secret. Information encrypted with the public key can only be decrypted with the private key, and vice versa. This property eliminates the key distribution problem of symmetric cryptography and enables digital signatures, key exchange, and public key infrastructure.

RSA — Rivest-Shamir-Adleman

RSA, invented in 1977, was the first practical public-key cryptosystem and remains the most widely deployed asymmetric algorithm in enterprise environments. RSA security is based on the difficulty of factoring the product of two large prime numbers. Key sizes must be 2048 bits minimum (NIST requirement for security through 2030) with 4096 bits recommended for long-term sensitive data.

Elliptic Curve Cryptography (ECC)

Elliptic Curve Cryptography provides equivalent or superior security to RSA at dramatically smaller key sizes. A 256-bit ECC key provides approximately the same security as a 3072-bit RSA key. This makes ECC significantly more efficient in computation, bandwidth, and storage — critical advantages for TLS performance, mobile devices, and IoT deployments.

Diffie-Hellman Key Exchange

The Diffie-Hellman (DH) key exchange protocol, invented in 1976, enables two parties to establish a shared secret over an insecure channel without prior shared knowledge. This breakthrough solved the fundamental key distribution problem of symmetric cryptography. Modern deployments use Elliptic Curve Diffie-Hellman (ECDHE) rather than the original finite-field DH.

Hash Functions, Message Authentication Codes, and Integrity Verification

Cryptographic hash functions are one-way mathematical functions that produce a fixed-length output (digest) from arbitrary-length input. They are the primary building block of cryptographic Integrity protection. A secure hash function makes it computationally infeasible to find two different inputs that produce the same output (collision resistance), or to find an input that produces a given output (preimage resistance). These properties make hashes ideal for verifying that data has not been modified.

Cryptographic Hash Algorithms

Message Authentication Codes (MACs)

A Message Authentication Code (MAC) is a cryptographic construction that uses a shared secret key to provide both data integrity and authentication. Unlike a hash function alone, a MAC can only be verified by parties who possess the secret key — preventing an attacker who knows the hash algorithm from generating a valid authentication tag for a modified message.

Password Hashing Functions

Password storage requires specialised hash functions designed to be intentionally slow and memory-intensive. Standard cryptographic hash functions (SHA-256, etc.) are too fast — an attacker with a GPU can test billions of password guesses per second against a SHA-256 hash database. Password hashing functions incorporate configurable work factors (iterations, memory cost) to make offline dictionary attacks computationally prohibitive.

Public Key Infrastructure and Digital Certificates

Public Key Infrastructure (PKI) is the framework of policies, procedures, hardware, software, and people that creates, manages, distributes, uses, stores, and revokes digital certificates and public keys. PKI bridges the gap between raw public-key cryptography and practical trust — it answers the question “whose public key is this?” through a chain of cryptographically verifiable trust anchors.

X.509 Digital Certificates

X.509 is the ITU-T standard format for public key certificates, used in TLS/HTTPS, S/MIME email signing, code signing, VPN authentication, and smart card-based authentication. A certificate binds a public key to an identity through a digital signature by a Certificate Authority (CA) that vouches for the binding.

Certificate Authorities and Trust Models

Cryptographic Protocols in Information Security

Cryptographic protocols combine cryptographic primitives (algorithms) with structured handshake, authentication, and session management procedures to provide complete security services over untrusted networks. The protocols described in this section are deployed in virtually every enterprise environment and understanding their cryptographic properties is essential for security architecture and configuration assessment.

TLS — Transport Layer Security

TLS (Transport Layer Security) is the cryptographic protocol that secures the majority of internet traffic: HTTPS web connections, email (SMTPS, IMAPS), API communications, database connections, and application protocols. TLS provides authentication, confidentiality, and integrity for data in transit. TLS 1.3 (RFC 8446, 2018) is the current standard; TLS 1.2 is still widely deployed; TLS 1.0 and 1.1 are deprecated and prohibited.

SSH — Secure Shell Protocol

SSH (Secure Shell, RFC 4251) is the standard cryptographic protocol for secure remote administration, file transfer (SFTP/SCP), and port forwarding. It replaced Telnet and FTP in enterprise environments in the late 1990s. SSH uses a hybrid cryptographic approach: asymmetric cryptography for host authentication and key exchange, symmetric cryptography for session encryption.

VPN Cryptography — IPsec and WireGuard

Cryptographic Tools and Implementation

Cryptographic security depends not only on mathematically sound algorithms but on their correct implementation. A theoretically perfect algorithm implemented incorrectly — with side-channel vulnerabilities, weak random number generation, or insecure key storage — provides no meaningful security. The tools described in this section are used by cryptographic engineers, security assessors, and system administrators for implementing, auditing, and testing cryptographic systems.

Cryptographic Libraries and Toolkits

TLS Configuration Assessment Tools

TLS configuration assessment tools evaluate the cryptographic security of TLS-protected services, identifying cipher suite weaknesses, protocol version vulnerabilities, certificate issues, and configuration flaws that undermine the Confidentiality and Integrity protections TLS is intended to provide.

Key Management Tools and Hardware Security Modules

Key management is the most operationally critical aspect of cryptographic security. A mathematically perfect encryption algorithm protects nothing if the key is insecurely generated, stored, or rotated. Hardware Security Modules (HSMs) provide tamper-resistant hardware-backed key storage and cryptographic operations for the most sensitive key material.

Post-Quantum Cryptography and Emerging Standards

Quantum computers, when sufficiently powerful, will break the asymmetric cryptographic algorithms (RSA, ECC, Diffie-Hellman) that underpin the majority of modern PKI, TLS, and digital signature infrastructure. Shor’s algorithm solves the integer factorisation and discrete logarithm problems that RSA and ECC respectively rely upon in polynomial time on a quantum computer. Symmetric algorithms (AES-256) and hash functions (SHA-256+) are significantly less affected — Grover’s algorithm halves their effective key length, but doubling key sizes (AES-256 provides adequate post-quantum security).

The “harvest now, decrypt later” threat — where adversaries record encrypted traffic today to decrypt it once quantum computers are available — means the migration to post-quantum cryptography is urgent even before large-scale quantum computers exist. NIST completed its Post-Quantum Cryptography standardisation process in 2024, publishing the first post-quantum algorithm standards.

NIST Post-Quantum Cryptography Standards (2024)

CIA Triad Cryptography Control Matrix

Effective cryptographic security program design requires systematic mapping of algorithms, protocols, and controls to CIA Triad pillars. The following matrix maps every major cryptographic primitive and protocol covered in this document to its primary CIA Triad contribution, enabling security architects to ensure balanced cryptographic protection across all three pillars.

Cryptographic Algorithm Selection Decision Framework

When selecting cryptographic algorithms for a new deployment, the following framework provides a structured approach to algorithm selection that accounts for security requirements, compliance obligations, performance constraints, and post-quantum migration timelines.