Last week, we dove into cryptography’s ancient past. This week, it’s time to take a look at the cryptography boom that came alongside the rise of computers. In just a few decades, we went from encrypting messages with rickety old machines to supercharged algorithms that allowed us to communicate securely in innovative ways.
Data Encryption Standard (DES)
The Data Encryption Standard (DES) was a critical turning point for cryptography. It’s a symmetric-key encryption scheme, which means that it uses the same key for both encryption and decryption. It was published as a Federal Information Processing Standard 46 in 1977 with the intention of it being used freely outside the military. It quickly became widespread.
DES has a block size of 64 bits and a key length of 56. In the early days, it was sufficient for keeping data safe, but as technology progressed it started to look weaker and weaker. By 1999, it could be cracked in less than a day, which was a serious concern. In response, FIPS 46-3 was issued, which favored a new algorithm, Triple DES. Triple DES essentially involves putting the plaintext through the original DES algorithm three times. While it wasn’t perfect, it bought us some time so that the National Institute of Standards and Technology (NIST) could come up with a new symmetric-key algorithm, the Advanced Encryption Standard (AES).
One of the most interesting things about DES was that the NSA was involved in its development and made some changes. There were suspicions that the NSA had deliberately weakened the algorithm so that it could crack encrypted text. The NSA has a controversial reputation, so these suspicions weren’t unwarranted.
It wasn’t until the nineties that we realized the NSA did meddle with the algorithm using some secret insights that only it knew at the time. The big surprise is that the NSA actually make DES stronger. While the NSA receives a lot of criticism for things like the Snowden revelations, there’s a substantial portion of the agency that really cares about helping to improve security.
The Advanced Encryption Standard (AES)
With DES vulnerable and Triple DES serving as a stopgap measure, NIST was rapidly developing and standardizing a new algorithm. It came to be called the Advanced Encryption Standard (AES), and it was published as FIPS 197 in 2001.
AES was a big step up. The algorithm was far more complex, and it could be implemented with key lengths of 128, 192, or 256 bits, all of which are still secure. We use AES almost everywhere that we need symmetric encryption. It protects your web connection when you visit DestCert.com via the TLS that provides the security layer of HTTPS. It also protects your messages in WhatsApp and Signal, and it helps to keep the data on your devices safe when you deploy full disk encryption (FDE).
AES is expected to remain secure for many years to come. Even if quantum computing becomes a reality, the best attacks only bring down the strength of AES-256 to a security level of 128 bits. For now, we should be comfortable using it for most applications. The main concern is for data that we expect to still be sensitive for many decades to come.
The public-key cryptography revolution
Better symmetric-key algorithms weren’t the only major cryptographic advances of the digital era. It’s fair to say that the most interesting advances came on the public-key side, which is also known as asymmetric encryption. Through algorithms like the Diffie-Hellman key exchange and RSA, we accomplished things like:
- Solving the key distribution problem – Before the Diffie-Hellman key exchange, we had no online way to establish a secure communications channel if we didn’t already have a pre-existing secure channel. The Diffie-Hellman key exchange allowed two or more parties to develop a secure symmetric key that they could then use to encrypt future communications. It works even if an attacker is listening in to the process.
- Developing schemes that provide integrity, authenticity and non-repudiation to our data – Asymmetric algorithms like RSA can be combined with cryptographic hashing to give us digital signatures. These allow us to verify whether a message was actually sent by the person who claims to have sent it, and not an impostor. They also allow us to check whether a message has been tampered with since it was created.
- Allowing key revocation and scalability – Symmetric-key encryption doesn’t scale very well, especially in large groups. If you wanted a group of 10,000 people to be able to communicate securely with symmetric-key encryption, you would need almost 50 million keys. With asymmetric cryptography you only need 20,000. Asymmetric cryptography also allows you to revoke keys when a user leaves the group.
We still use the Diffie-Hellman key exchange for key distribution, while RSA is mostly used for digital signatures. Elliptiic-curve cryptography (ECC) is starting to see more use because it has a smaller key size and it’s faster. However, quantum cryptography poses a major threat to these algorithms. The good news is that NIST is already standardizing quantum-safe algorithms, and the rise of quantum computing still seems a long way away.
As we've seen, cryptography is a critical tool in securing digital communications and protecting data integrity. Understanding its evolution and complexity is essential for professionals in information security. Here is where the CISSP Certification comes into play. It acknowledges an individual's expertise in various cybersecurity domains, including aspects of modern cryptography. Therefore, professionals with CISSP training are well-equipped to stand up to the challenges of today's advanced cyber threats.
