Symmetric and Asymmetric Cryptography - SY0-601 CompTIA Security+ : 2.8

Summary

The transcript explains the differences between symmetric and asymmetric encryption. Symmetric encryption uses a single key for both encryption and decryption, posing scalability challenges when sharing the key securely. Asymmetric encryption, also called public-key cryptography, uses a public and private key pair, offering a more secure key exchange method. However, it requires more computational resources. The two methods are often combined to securely share symmetric keys. Additionally, the transcript introduces Elliptic-Curve Cryptography (ECC), which provides efficient encryption for devices with limited computing power, like mobile and IoT devices.

Takeaways

• 🔑 Symmetric Encryption: This encryption method uses a single key for both encrypting and decrypting data. If the key is compromised, all encrypted data must be re-encrypted.
• 🗝️ Symmetric Encryption Challenges: Scaling symmetric encryption is difficult because the single key must be securely shared without a secure means to do so over the network.
• 🔒 Asymmetric Encryption: Asymmetric encryption, also known as public-key cryptography, uses a pair of keys: a public key that is shared and a private key that is kept secret.
• 📜 Public vs. Private Keys: The public key is distributed widely, while the private key is kept secret. Information encrypted with one key can only be decrypted by the other key in the pair.
• 🔁 Combining Encryption Methods: Symmetric and asymmetric encryption are often used together; asymmetric encryption is used to securely share a symmetric key, which is then used for faster encryption and decryption.
• 🖊️ Digital Signatures: Asymmetric encryption allows the creation of digital signatures by encrypting data with a private key, which can only be verified using the corresponding public key.
• 📐 Key Generation: Asymmetric encryption keys are generated together through a key generation program using large random and prime numbers, producing mathematically related public and private keys.
• 📨 Encryption and Decryption Process: To send an encrypted message, one party uses the recipient's public key. The recipient can only decrypt this message with their private key, ensuring secure communication.
• 🔄 Symmetric Key Creation with Asymmetric Encryption: Asymmetric encryption allows two parties to create identical symmetric keys using each other's public and private keys without transmitting the key itself.
• 📉 Performance Considerations: Asymmetric encryption requires significant computational resources, making it less suitable for devices with limited processing power, such as mobile and IoT devices. Elliptic-Curve Cryptography (ECC) provides a more efficient alternative with smaller keys and reduced overhead.

Q & A

What is symmetric encryption?

Symmetric encryption is a type of encryption where a single key is used to both encrypt and decrypt data. The same key must be shared between the sender and the receiver.

What is the main challenge of using symmetric encryption?

The main challenge is securely sharing the key between the sender and receiver. If the key is exposed, the data can be decrypted by unauthorized parties, requiring re-encryption with a new key.

Why is symmetric encryption difficult to scale?

Symmetric encryption is difficult to scale because sharing the encryption key securely over a network without first encrypting it is a challenge, as there's no easy way to transmit it safely.

What is asymmetric encryption?

Asymmetric encryption, also known as public-key cryptography, uses two keys: a public key to encrypt the data and a private key to decrypt it. Each key is mathematically related but cannot be used to derive the other.

How are public and private keys used in asymmetric encryption?

In asymmetric encryption, the public key is shared with everyone, and anyone can use it to encrypt a message. Only the person with the corresponding private key can decrypt that message.

What is a common use case for asymmetric encryption?

A common use case for asymmetric encryption is securing communications over the internet. It is often used for digital signatures and encrypting data before sending it.

How are symmetric and asymmetric encryption combined?

Symmetric and asymmetric encryption are often combined by using asymmetric encryption to securely exchange a symmetric key, which is then used for efficient encryption and decryption of the actual data.

What is the process of key generation in asymmetric encryption?

In asymmetric encryption, a key generation program uses large random and prime numbers to create two keys: a public key and a private key. These two keys are mathematically related but cannot be used to derive one another.

What is the Diffie-Hellman key exchange?

The Diffie-Hellman key exchange is a method used to securely create a symmetric key between two parties over a network, without needing to send the symmetric key itself. It uses asymmetric encryption to accomplish this.

What is Elliptic-Curve Cryptography (ECC), and why is it useful?

Elliptic-Curve Cryptography (ECC) is a type of asymmetric encryption that uses mathematical curves to generate smaller, more efficient keys. ECC provides the same security as traditional algorithms but with reduced computational power, making it ideal for mobile and IoT devices.

Outlines

00:00

🔐 Introduction to Symmetric Encryption

This section introduces symmetric encryption, explaining that it uses a single key for both encryption and decryption. The same key must be kept secret, and if compromised, all encrypted data is at risk. It's referred to as a 'secret-key algorithm' or 'shared secret.' A major challenge of symmetric encryption is scalability, particularly in securely sharing keys across networks without an initial secure method to do so.

05:01

🧑‍💻 Challenges and Solutions with Asymmetric Encryption

Here, the video transitions to asymmetric encryption, highlighting its use of two keys: a public key, which is shared, and a private key, which remains secret. This form of encryption, also known as public-key cryptography, is commonly used for secure communications. While it's more secure than symmetric encryption, it also requires more computational resources. Asymmetric encryption often works in combination with symmetric encryption, allowing the secure exchange of a symmetric key for faster encryption processes.

🔑 Public and Private Key Cryptography

The section elaborates on the mathematical relationship between public and private keys in asymmetric encryption. It explains how these keys are generated simultaneously and how the private key remains confidential while the public key can be widely distributed. The video emphasizes that, despite being mathematically related, it is impossible to derive the private key from the public key. This makes asymmetric encryption essential for securing modern internet communications.

💻 Encrypting and Decrypting Messages with Asymmetric Encryption

This part covers how Bob uses Alice’s public key to encrypt a message, ensuring that only Alice can decrypt it using her private key. The process ensures the security of communications over networks. The video explains how the same principle applies when Alice sends encrypted messages to Bob using his public key, emphasizing the unidirectional nature of public key encryption.

🔄 Combining Asymmetric and Symmetric Encryption

Asymmetric encryption's difficulty in scaling due to key transmission challenges leads to a solution: using asymmetric encryption to create a symmetric key on both sides of a communication. By combining private and public keys, Bob and Alice can generate an identical symmetric key without transmitting it. This concept is the foundation of the Diffie-Hellman key exchange, which is frequently used in secure communications.

⚙️ Efficiency of Elliptic-Curve Cryptography (ECC)

The video concludes with a discussion on the computational overhead of asymmetric encryption, especially for devices with limited processing power, such as mobile or IoT devices. To address this, Elliptic-Curve Cryptography (ECC) offers a more efficient method of encryption, using smaller keys while maintaining security. ECC is suitable for environments requiring lower storage and transmission requirements, providing an efficient alternative to traditional asymmetric encryption methods.

Keywords

💡Symmetric Encryption

Symmetric encryption is a method where a single key is used to both encrypt and decrypt data. This is central to the video’s discussion, as it highlights the simplicity and efficiency of this method, but also its major drawback: if the key is exposed, all data encrypted with it becomes vulnerable. In the script, it's referred to as a 'secret-key algorithm' because the same key must remain secret between parties.

💡Asymmetric Encryption

Asymmetric encryption uses two keys: a public key for encryption and a private key for decryption. The video explains this concept by contrasting it with symmetric encryption, showing that while asymmetric encryption is more secure for sharing data across networks, it comes with higher computational costs. The script mentions its use for creating secure communication channels, particularly in internet-based interactions.

💡Public Key

A public key is part of asymmetric encryption and is shared openly with others to allow them to encrypt messages meant for the owner of the corresponding private key. In the video, it's explained that public keys can be posted on websites or public key servers, allowing people like Bob and Alice to securely exchange encrypted messages.

💡Private Key

A private key is the secret counterpart to a public key in asymmetric encryption. It is kept secure by the owner and is the only key capable of decrypting messages encrypted with the corresponding public key. The script emphasizes its importance in maintaining security, as only the owner of the private key can decrypt the data.

💡Ciphertext

Ciphertext is the encrypted form of plain text that cannot be read unless decrypted. In the video, Bob encrypts his message ('Hello Alice') into ciphertext using Alice's public key, which can only be decrypted by Alice with her private key, illustrating how ciphertext functions in secure communications.

💡Digital Signature

A digital signature is a mechanism that allows for the authentication of a message or document using encryption. The video briefly touches on this, explaining that when someone encrypts a message with their private key, it serves as a digital signature, as only the corresponding public key can verify the message’s authenticity.

💡Diffie-Hellman Key Exchange

The Diffie-Hellman Key Exchange is a cryptographic method used to securely exchange cryptographic keys over a public channel. The script explains that this process helps create a symmetric key on both sides of a communication without needing to transmit the key over the network, enhancing security.

💡Elliptic-Curve Cryptography (ECC)

ECC is an efficient form of asymmetric encryption that uses mathematical curves rather than large prime numbers. The video explains that this method reduces the computational load and is particularly useful for devices with limited resources, such as mobile or IoT devices, while still providing strong security.

💡Key Pair

A key pair refers to the combination of a public key and a private key generated together in asymmetric encryption. The video describes how both keys are mathematically related and generated from a single process using large random and prime numbers. One key becomes public, while the other remains private.

💡Scalability

Scalability refers to how easily a system can expand or adapt to increasing demands. In the context of the video, scalability is discussed as a limitation of symmetric encryption, where sharing the single key securely across many users becomes impractical, leading to the adoption of asymmetric methods for key exchange.

Highlights

Symmetric encryption uses a single key for both encryption and decryption, which poses a security risk if the key is compromised.

Symmetric encryption is also known as a secret-key algorithm or a shared secret because the same key is used by both parties.

A major challenge with symmetric encryption is scaling, as it's difficult to securely share the key with others over a network.

Asymmetric encryption solves the problem of sharing keys securely by using a pair of keys – a public key and a private key.

Asymmetric encryption involves more CPU overhead compared to symmetric encryption, requiring more computational resources.

Asymmetric encryption often works in conjunction with symmetric encryption to securely share a symmetric key for further encryption.

In asymmetric encryption, the public key can be freely shared, while the private key remains confidential and is used for decryption.

Only the corresponding private key can decrypt data encrypted with the public key, ensuring secure communication.

You can also encrypt data with a private key and allow others to decrypt it using the public key, which is the basis for digital signatures.

Although the public and private keys are mathematically related, knowing the public key doesn't allow someone to deduce the private key.

The process of creating a public-private key pair uses random numbers and prime numbers, generating two mathematically linked keys.

Asymmetric encryption allows Alice to send encrypted information to Bob using Bob's public key, and only Bob can decrypt it with his private key.

To avoid transmitting symmetric keys over a network, Diffie-Hellman key exchange allows both parties to independently generate the same symmetric key.

Elliptic-Curve Cryptography (ECC) provides the benefits of asymmetric encryption while using smaller keys, reducing CPU and storage requirements.

ECC is particularly beneficial for mobile devices and IoT devices with limited computing power, enabling secure encryption with minimal overhead.

Transcripts

Let's begin our conversation of the differences

between symmetric encryption and asymmetric encryption,

by focusing first on symmetric encryption.

This is encryption where you use a single key

to encrypt the data, and when you want to decrypt the data,

you use exactly the same key to decrypt it.

This means that if this key does become available for others

to see, that you'll have to completely redo

all of your encryption because now everyone has

a copy of the key that can be used to decrypt this data.

You'll sometimes hear symmetric encryption

referred to as a secret-key algorithm or a shared secret.

That's because that single key is the secret

that everyone needs to know, to be able to decrypt

the information.

One of the challenges you have with symmetric encryption

is it's difficult to scale.

How do you share a key with others,

when you don't currently have a way

to encrypt that information.

You can think of this as somebody

carrying the key in a locked case,

they're protecting the key until they get to their destination,

and only then can they share that key with another person.

But across the network, you don't have a locked case.

And since you don't have a key that both sides can share,

you don't have a way to encrypt the key, to be able to send it

to the other side.

This means we have to find other ways

to be able to share this key so that we

can use symmetric encryption.

One way to get around this problem of scalability

is to use asymmetric encryption.

The problem, though, is that asymmetric encryption

requires more overhead and more work by the CPU.

Symmetric encryption requires relatively fewer resources

than asymmetric encryption.

Often, you'll see the two combine,

where you'll use asymmetric encryption in order

to transfer a symmetric key to someone else.

So very often those two algorithm types

are used in conjunction with each other.

Unlike symmetric encryption, where there is a single key,

with asymmetric encryption, there are multiple keys.

You'll sometimes hear this referred

to as public-key cryptography, because, there is

a public key and a private key.

In some situations, there can even be more than two keys,

but for the examples that will give today,

we'll deal with the two keys, a public key,

and the private key.

The private key as the name implies,

is the key that only you have access to.

It is a private key because nobody else

knows what that key is.

There is another key that is mathematically

related to the private key called the public key.

This is the key that you give to everybody.

You can post the public key on a public key server,

you can hand it out to people in email messages,

you can put it on your website, and everyone

who wants to be able to encrypt information and send it to you

needs to have your public key.

Once somebody encrypts data with that public key,

the only way to decrypt that information

is by using the corresponding private key,

and of course, that's the key that only you have access to.

Interestingly enough, you can also do this the opposite way.

You can encrypt information with your private key,

and the only people that would be able to decrypt it,

are the people that have the public key.

This is the process that we would

use for doing something like, a digital signature, for example.

So although we've named these keys public and private,

they're really only named that way,

because that's how we're using them.

The two keys are mathematically related and depending

on which one you choose when you create the keys,

is the one that becomes the private key,

and the one that becomes the public key.

Although these two keys are mathematically related,

you still can't derive one key from the other.

If everyone has access to the public key,

they still would not be able to determine

what the private keys should be, even

though they have full access to every part of the public key.

It's this interesting relationship

between the public and the private key,

that enables us to use the encryption that we

have today on the internet.

To better understand this relationship between the public

and the private key, let's go back

to when we originally create this key pair when

using asymmetric cryptography.

We would build both of these keys at the same time.

We have a large random number, there's

a key generation program, that is input,

and the output to that program, creates

the two keys, the public key, and the private key.

By running this key generation program, which

uses large random numbers, and prime numbers as input,

it runs it through a generation program,

and it outputs two separate keys.

Of those two keys, we choose one of them to be the public key,

and one of them to be the private key,

and then we share the public key with everybody,

and we keep the private key private to us.

Let's look at the process that's involved

in encrypting and decrypting information

using asymmetric cryptography.

Let's take a scenario, where Bob and Alice are communicating

to each other, and Bob would like to send some information

to Alice that is encrypted.

Bob will need a way to create this encrypted message,

like a laptop.

He'll need the original plain text.

This plain text says, Hello Alice,

and then he'll need Alice's public key.

To obtain this key, Bob can ask Alice for her public key,

he can retrieve her public key from a public key server,

or he can visit Alice's home page or anywhere else

Alice may have posted the key and download

the key from there.

Bob then combines the plaintext, with Alice's public key,

to create the ciphertext.

Once the ciphertext has been created,

the only way to obtain the original plaintext

is to decrypt it with the private key.

You cannot use the public key to somehow undo the encryption

process that you've already done.

This means that Alice will receive the ciphertext message,

and will apply her private key, to be

able to decrypt that ciphertext, and once that's decrypted,

she'll be able to see the plain text that says, Hello Alice.

This is the process that occurs every time someone wants

to send information using asymmetric encryption.

If we wanted to reverse this process

and have Alice send encrypted information to Bob,

she would need Bob's public key, she would encrypt the data,

send that ciphertext to Bob, and Bob would use his private key,

to decrypt that ciphertext.

We spoke earlier of the difficulties

in being able to scale asymmetric key,

because there's no easy way to transmit

that symmetric key across the network,

without first encrypting it.

And since you haven't sent the key across the network,

there's no way to have a known key on both sides,

that you can use for the encryption process.

One way to get around this problem

is to use asymmetric encryption, in order

to create a symmetric key on both sides,

without having to send that symmetric key

across the network.

To be able to do that, you use public and private keys

on both sides.

Let's take the example again of Bob and Alice.

We know that Bob and Alice use asymmetric encryption, which

means, that Bob has a private key,

and Alice has a private key, and of course those private keys

are only known to their owners.

You can combine your private key,

with someone else's public key, to create a symmetric key.

And if you use the related public and private keys

on both sides, you end up with a symmetric key

that's identical to each other.

So even though Bob's private key and Alice's public key

created the symmetric key, it's exactly the same symmetric key,

if you combine Alice's private key and Bob's public key.

By doing this, the same symmetric key

can be created on both sides of the conversation,

without ever having to send the symmetric key

across the network.

In fact, this is the process used

for Diffie-Hellman key exchange, and it's

a key exchange process that's used extensively every day.

Hopefully, you're starting to see that asymmetric encryption,

can provide us with functionality

that symmetric encryption simply can't do.

But there are some drawbacks to using asymmetric encryption.

We're using very large integers of very large prime factor

numbers, and that calculation requires CPU overhead

and resources on a machine, to be able to encrypt and decrypt

that information.

Of course, we have mobile devices, and internet

of things devices, that may not have the computing

power that our local workstations have,

but they still need to be able to encrypt and decrypt

information.

For those, we would use, Elliptic-Curve Cryptography,

or ECC.

Instead of using these very large prime numbers,

we'll use curves, to be able to create,

the asymmetric keys that we would

use for public and private key encryption and decryption.

ECC can use smaller keys, to maintain the same security

as non-ECC algorithms, and they require,

a smaller amount of storage and a smaller amount

of data that would need to be transmitted across the network.

This allows us to have access to the powerful features

available with asymmetric encryption,

while we're using our mobile devices and IoT devices.