By Rick Hayoun - Security Consultant
In this article, we will lay the groundwork for a better understanding of the concept of encryption and its main principles. To introduce the subject of encryption in the best possible way, let's start with a few essential definitions.
Some basic concepts
- Plain text: Text that can be understood by everyone.
- Encrypted text: Text that is protected by encryption and therefore incomprehensible.
- Encryption: A reversible method that involves transforming a plaintext message into a ciphertext message using an encryption algorithm with its encryption key.
- Hash function: An irreversible method that transforms a plaintext message into a ciphertext message using a hash algorithm. It can also be used with a secret key, but this is not mandatory.
- Encryption algorithm: Mathematical formula used to encrypt and/or decrypt data.
- Encryption key: A secret key that, when combined with an encryption algorithm, enables the encryption and/or decryption of a message.
- Decryption: A method that involves converting an encrypted message into a plaintext message using an encryption algorithm and knowing its encryption key.
- Decryption: A method that consists of translating an encrypted message into a plaintext message without knowing the encryption key.
So, in the end, do we say "encrypt" or "cipher"?
The word "encryption" is inappropriate. In fact, based on the information obtained from the above definitions, "encrypting" would mean protecting a message with a key that we do not know... which does not really make sense. The term that should be used is therefore "encoding a message."
Key principles
The use of encryption, or more generally cryptology, is based on four main principles: confidentiality, integrity, authentication, and non-repudiation.
Confidentiality makes information unintelligible to anyone who is not authorized to access it. Integrity ensures that data is not altered during communication, mainly through the use of hashing functions. Attacks on integrity are called "substitutions." Authentication allows the identity of each party to be verified. Attacks on authenticity are called "masquerades" or "impersonations." Non-repudiation guarantees that none of the parties can deny having sent or received the message, which is essential for transactions with electronic signatures.
Conclusion
Encryption algorithms therefore allow us, after defining an encryption key, to protect data so that only the people concerned can access it. Given that encryption algorithms are supposed to be known to everyone, only the key will allow us to guarantee secrecy.
This raises several questions... How should this secret key be defined? How can we ensure that it is sufficiently protected to guard against attacks?
See also: Symmetric and asymmetric encryption
