After completing this tutorial, you should be able to:
Throughout Unit 2, we have systematically explored the building blocks of modern cryptography: symmetric encryption, hash functions, MACs, random number generation, public-key cryptography, digital signatures, key exchange, and the protocols that tie them together. This final tutorial synthesizes these components into a holistic view of cryptographic security and examines how they are applied in real-world systems.
We begin by revisiting the cryptographic primitives and how they are composed to achieve security services: confidentiality, integrity, authentication, and non-repudiation. We then dive deep into four case studies that illustrate the integration of these primitives in practice:
We also discuss common pitfalls in cryptographic implementations, side-channel attacks, and the emerging landscape of post-quantum cryptography. The goal is to equip you with the ability to critically evaluate and design secure systems using the principles and tools covered in this unit.
This tutorial integrates material from Tutorials 2.1–2.16, providing a capstone for Unit 2. It prepares you for the next unit on Authentication and Access Control by showing how cryptographic security is applied in practice.
Modern secure systems do not rely on a single primitive but compose them to achieve multiple security goals. The following table maps primitives to services:
| Security Service | Primary Primitive(s) | Example |
|---|---|---|
| Confidentiality | Symmetric encryption (AES), Asymmetric encryption (RSA/ECC) | AES-GCM for bulk data, RSA-OAEP for key wrapping |
| Integrity | Hash functions (SHA-2, SHA-3), MACs (HMAC) | SHA-256 for file checksums, HMAC-SHA256 for message authentication |
| Authentication | Digital signatures, MACs | ECDSA for certificate validation, HMAC for session authentication |
| Non-repudiation | Digital signatures | RSA-PSS for signed documents |
| Key Exchange | Diffie-Hellman (DHE/ECDHE) | ECDHE in TLS for forward secrecy |
| Randomness | CSPRNGs | CTR_DRBG for session keys |
A typical secure communication system (e.g., TLS) follows a pattern:
This layered approach provides defense in depth: if one primitive is broken, the others may still protect the system.
TLS 1.3 (RFC 8446) represents the culmination of lessons learned from decades of protocol vulnerabilities. It is designed with security by default, removing legacy algorithms and mandating forward secrecy and authenticated encryption.
Figure 1: TLS 1.3 handshake (abbreviated).
The Signal Protocol is the gold standard for end-to-end encrypted messaging, used in Signal, WhatsApp, and Facebook Messenger. It provides confidentiality, integrity, authentication, forward secrecy, and even deniability (the ability to plausibly deny having sent a message).
The Double Ratchet ensures that every message uses a new key derived from the previous one. If a key is compromised, it only affects messages that have not yet been sent (forward secrecy) and future messages can recover security if one side sends a new DH ratchet step (post-compromise security).
Because Signal uses ephemeral keys and the signature keys are not directly used for message signing, it is possible for a participant to plausibly deny having sent a message (since the keys are ephemeral and could be forged by either party).
Bitcoin is a decentralized cryptocurrency that relies heavily on cryptography. It uses:
Transactions are signed using ECDSA on the secp256k1 curve. Each transaction requires a signature from the sender's private key to authorize spending the funds.
Transactions are hashed into a Merkle tree, with the root hash included in the block header. This allows efficient verification of a transaction without downloading the entire block.
Public Key Infrastructure (PKI) relies on Certificate Authorities (CAs) to validate identities. Several high-profile CA compromises have eroded trust and led to improvements.
CT is a public logging system that requires CAs to publish all issued certificates in publicly auditable logs. This allows domain owners and browsers to detect misissuance.
Browsers require CT for certificate validation; certificates must be included in at least two logs.
Despite the strength of cryptographic primitives, systems are often broken due to implementation errors, poor design, or misuse. Here are common pitfalls and how to avoid them:
Weak random number generation leads to predictable keys. Use a CSPRNG and ensure proper seeding. The Debian OpenSSL RNG vulnerability is a classic example.
In CTR, GCM, and ECDSA, nonce reuse is catastrophic. Use deterministic nonces (RFC 6979 for ECDSA) and ensure IV uniqueness in GCM.
CBC with PKCS#7 padding is vulnerable to padding oracle attacks. Use AEAD modes (GCM, CCM) or Encrypt-then-MAC.
Non-constant-time operations leak information. Use constant-time algorithms and verify comparisons with timing-safe functions.
Storing keys insecurely, reusing keys for multiple purposes, or failing to rotate keys compromises security. Use HSMs and follow key lifecycle best practices.
Attackers force use of weaker protocols. Implement strong downgrade protection and disable legacy versions.
Protocols must be able to replace deprecated algorithms. Plan for algorithm agility from the start.
Complex implementations increase bug risk. Use well-tested libraries and formal verification when possible.
Cryptography is continuously evolving to address new threats and challenges:
Quantum computers, using Shor's algorithm, will break RSA, DSA, ECDSA, and ECDH. NIST is standardizing post-quantum algorithms, including:
Transitioning to PQC will take years and requires careful hybrid deployment (classical + post-quantum) to ensure backwards compatibility.
Allows computations on encrypted data without decrypting. This enables privacy-preserving analytics and secure cloud computing. Fully homomorphic encryption (FHE) remains computationally expensive but is improving.
Allow a prover to convince a verifier of a statement without revealing any additional information. Used in privacy-preserving cryptocurrencies (Zcash) and authentication protocols.
Enables multiple parties to jointly compute a function on their private inputs without revealing them. Used in financial and healthcare applications.
Given the ciphersuite TLS_AES_256_GCM_SHA384, explain what each part means and why it is considered secure.
TLS: Protocol.
AES_256_GCM: AES with 256-bit key in Galois/Counter Mode—provides confidentiality and authentication.
SHA384: Hash function for the PRF and transcript hash; provides 384-bit security.
This ciphersuite is secure because it uses AEAD (no padding oracles), large key size, and strong hash.
Explain how the Signal Protocol provides forward secrecy even if a user's long-term identity key is compromised.
Signal uses ephemeral keys for each session (X3DH and Double Ratchet). The identity key is only used for authentication during the initial key exchange. Session keys are derived from ephemeral DH exchanges, so compromising the identity key does not reveal past or future session keys (if ratcheting is used).
What would happen if an attacker could find a collision in SHA-256? How would it affect Bitcoin?
If SHA-256 collisions were practical, an attacker could create two different blocks with the same hash, potentially allowing double-spending or disrupting the blockchain's integrity. The Merkle tree would also be vulnerable, allowing transaction forgery. However, SHA-256 is still collision-resistant, and Bitcoin would likely migrate to a stronger hash.
Describe how Certificate Transparency (CT) helps detect CA misissuance, and why CRLs and OCSP are insufficient.
CT requires CAs to publish certificates in public logs. Domain owners can monitor these logs for certificates issued without their authorization. CRLs and OCSP only handle revocation of known certificates, not detection of fraudulent ones; they are reactive, whereas CT is proactive.
Explain how a timing attack could compromise a cryptographic implementation, and describe a common mitigation.
A timing attack exploits variations in execution time to infer secret information (e.g., a private key). For example, comparing a MAC with a constant-time function versus short-circuiting on first mismatch. Mitigation: use constant-time comparison functions and ensure all code paths take the same time regardless of input.
Write a 600-word report on the NIST Post-Quantum Cryptography standardization process. Include the selected algorithms, their security foundations, and expected timelines for deployment.
Complete answer would cover the NIST PQC competition, the finalists (CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, SPHINCS+), their security assumptions (lattice-based, hash-based), and the timeline for standardization and eventual migration.
Research the KRACK attack on WPA2. Write a 500-word report covering the vulnerability, the cryptographic weakness (nonce reuse), the impact, and the mitigation.
Complete answer would describe the 4-way handshake vulnerability, the forced nonce reuse, the ability to decrypt packets, and the patch to clients and APs.
Write a 500-word comparison of the Signal Protocol and PGP for secure messaging. Address authentication, forward secrecy, deniability, and usability.
Complete answer would contrast Signal's ephemeral key ratcheting and deniability with PGP's static keys and non-repudiation. It would discuss Signal's better forward secrecy and user experience.
Design a secure file transfer protocol using the primitives from this unit. Specify the key exchange, encryption, authentication, and integrity mechanisms. Explain how you ensure forward secrecy and resistance to MITM attacks.
Complete answer would propose using ECDHE for key exchange, certificates for authentication, AES-GCM for encryption, and a KDF for key derivation. It would include a handshake with signatures and a record layer with AEAD, and mention forward secrecy.
Implement a simple command-line messaging system that uses ECDH for key exchange and AES-GCM for encryption. Include key generation, mutual authentication (using pre-shared public keys), and a simple chat interface. Report on your design and implementation challenges.
Complete answer would include code (e.g., Python with cryptography libraries), a protocol description (Alice and Bob exchange ephemeral public keys, compute shared secret, derive keys, send encrypted messages), and discuss challenges like nonce management, serialization, and error handling.
This tutorial has synthesized the cryptographic primitives and protocols of Unit 2 into a comprehensive understanding of real-world security systems. We revisited the integration of symmetric and asymmetric cryptography, hash functions, MACs, and key exchange, showing how they combine to provide confidentiality, integrity, authentication, and non-repudiation.
Through detailed case studies, we examined:
We also cataloged common pitfalls—entropy weaknesses, nonce reuse, side channels, and key management failures—and discussed the emerging landscape of post-quantum cryptography, homomorphic encryption, and zero-knowledge proofs.
This unit has equipped you with the foundational knowledge to understand, analyze, and design cryptographic security systems. The principles and tools you have learned are applicable across all domains of computer security, from networking to storage to applications.
As you move to Unit 3 (Authentication and Access Control), you will see how cryptographic mechanisms are used to verify identities and enforce access policies.
In Unit 3: Authentication and Access Control, we will build on cryptographic foundations to explore authentication protocols, identity management, access control models, and authorization frameworks. The cryptographic primitives from this unit (hash functions, digital signatures, symmetric encryption) are central to secure authentication.