Answer in Brief: Cryptography involves the science of utilizing mathematics for encryption and decryption of data, thus facilitating the process of secure communications through untrusted networks, where only the intended recipients have the ability to understand the confidential information. Cryptography is the underlying technology that secures all your transactions on a daily basis.
Why Cryptography Matters More Than Ever Right Now
Each time you access your bank balance, send a WhatsApp message, or log in to your email account, the process of cryptography is at work behind the scenes.
However, here is the thing: most people do not know the said shield is facing the greatest threat that it has ever faced within the last three decades. The development of quantum computers has been going ahead of schedule, and the encryption algorithms used for protecting the internet over the last thirty years have suddenly become vulnerable. There is already a race between governments and technology companies for developing new algorithms.
The necessity to understand what is cryptography, how it works, and what changes it is going through now becomes an obligatory piece of information for each person who lives in the world of connections.
What Is Cryptography? The Real Definition
Cryptography is the science and practice of making secure communications such that only the right person can decipher the secret message. This term has been derived from the Greek words kryptos (hidden) and graphein (writing). Thus, it means secret writing.
However, the meaning of this term conceals a lot of complexity. Cryptography does not simply hide the messages nowadays; it proves the identity of the sender, ensures the integrity of the message, and builds trust between total strangers over an unsafe network.
Here’s the fundamental concept in one sentence: Cryptography employs mathematical algorithms to scramble data into unreadable gibberish (encryption) and make it readable again (decryption) only for the owner of a specific key.
For example, you want to send a message to your friend using cryptography. It gets intercepted by some stranger in the middle. With the use of cryptography, he will see nothing but random characters. And your friend, who possesses the right key, will be able to restore your message.
The Basic Vocabulary
In order to continue, let us first clarify the meaning of the necessary terms:
- Plaintext: Original message, which is read by the person.
- Ciphertext: The coded, indecipherable message resulting from encryption
- Ciphertext: Unreadable message after encryption.
- Encryption: The method of transforming plaintext into ciphertext.
- Decryption: The reverse method of transforming ciphertext into plaintext.
- Key: The secret number needed for both the encryption and decryption of the message. The ciphertext produced by different keys will be different from the same plaintext.
- Cipher: The mathematical algorithm for encryption and decryption.
- Cryptosystem: Algorithm, set of possible keys, and protocols making the whole thing work.
The security of the cryptosystem is ensured by two components: the strength of the mathematical algorithm and the secrecy of the key.
The Fundamental Principle: Kerckhoffs’s Principle
There is an interesting fact that is very important for encryption but sounds counterintuitive. In modern cryptography the algorithm is not supposed to be kept a secret. It should be openly available and yet still secure.
Auguste Kerckhoffs defined this concept in 1883. A cipher should be able to become known to the enemy without causing any inconvenience.
The reason behind this is historical evidence that algorithms will eventually be exposed. They will be deconstructed; employees will reveal them, and the only one thing that should stay a secret is the key.
All aspects of modern cryptography rely on this concept. Open algorithms such as AES and RSA are scrutinized by thousands of researchers from all over the world. They are constantly being tested for vulnerabilities. Once the weakness is detected, it is fixed.
The Ancient Origins: Cryptography Before Computers
Cryptography is not new. Ever since the existence of societies that had to hide their information, they’ve been using cryptography to do so.
The Spartan Scytale (5th Century BC)
The oldest known cryptographic tool ever devised was the Spartan scytale. Papyrus paper was wound around a wooden stick of precise diameter. Then, the message would be written on the paper. Once unwound, the message seemed to consist of random letters. The reader had to know the diameter of the stick in order to properly decipher the message.
The Caesar Cipher (1st Century BC)
Julius Caesar used a very simple substitution cipher to encode his military messages. The letters were shifted in the alphabet for a certain number of positions. For instance, if the shift is three, A would become D, B would become E, and so on.
This type of cipher is referred to as a substitution cipher because each character is replaced by another. This technique is easy to understand but also easy to crack. There are only 26 shifts available with Caesar’s cipher.
Al-Kindi’s Frequency Analysis (9th Century)
An Arab scholar called Al-Kindi wrote the first manuscript of cryptanalysis. He came up with the concept of frequency analysis: there are always some letters that occur more often than the others in any language. In the English language, for instance, E is the most frequent letter, followed by T, A, O, and I. Using the frequency analysis technique, a cryptanalyst is able to establish substitution rules without knowing the key.
It became evident that substitution ciphers were insecure, and the battle between cryptography and cryptanalysis started.
Polyalphabetic Ciphers and the Vigenère Cipher
In order to make ciphers immune to frequency analysis, cryptologists began developing polyalphabetic ciphers, which use several substitution alphabets rather than one. The Vigenère cipher, which was invented in the 16th century, used a keyword to shift letters differently depending on their position in the message.
For hundreds of years it was considered to be an absolutely secure cipher. But it was not. Friedrich Kasiski published a way to crack the Vigenère cipher in 1863. Conclusion: complexity does not mean security.
The Machine Age: Enigma and the Birth of Modern Cryptanalysis
World War II revolutionized cryptography by turning it from a laborious manual process to an industrial one.
The Enigma Machine
For the encoding of the messages, Germany employed the machine known as the Enigma machine, which was a rotor-based machine. Every time the key was pressed, a new encrypted letter would be generated due to the flow of electricity from the rotation of certain wheels.
The keyspace of the Enigma machine was huge. It was impossible to break the code using brute force techniques.
Bletchley Park and Alan Turing
Alan Turing and his team working at Bletchley Park developed a machine known as Colossus. Colossus was considered one of the earliest machines that could crack the Enigma code. This development not only won the war, but it also demonstrated that computing power will dominate the future of cryptography.
The period was also characterized by the use of mathematical theories of cryptography. In his article “Communication Theory of Secrecy Systems,” published in 1945, Claude Shannon demonstrated the principles of information theory in the area of cryptography. Shannon was able to demonstrate that the one-time-pad encryption method is absolutely secure. The problem of one-time pad encryption is that you must share a key that has the size of the message being encoded.
Computer Age: DES, AES, and the Symmetric Cryptography Breakthrough
With the advent of computers everywhere, there arose the need for cryptography to be digitized.
Data Encryption Standard (DES)
The Data Encryption Standard (DES) was adopted in 1977 by the National Bureau of Standards (today NIST). It was invented by IBM under the supervision of the NSA, and it used 56-bit keys and 64-bit blocks.
Considering its time, DES was incredibly strong. Supercomputers could not crack it using the brute-force method back then. But the computing power kept on increasing. In 1999, a distributed attack with 100,000 computers was able to find a DES key within 22 hours. Thus, DES was broken.
DES was tripled in what is known as Triple DES (3DES).
The Advanced Encryption Standard (AES)
In a public competition held by NIST, AES emerged as the winner to replace DES. This occurred in 2001.
AES uses a 128-bit block size with key sizes of 128, 192, or 256 bits. There are 10, 12, or 14 rounds of transformations depending on the key size. The encryption method is highly efficient and secure.
AES-256 is used by the NSA to encrypt top secret data. AES cannot be compromised by any known attack on its implementation.
Symmetric Cryptography: One Key to Rule Them All
DES and AES belong to the symmetric class of cryptography, where a single key is used to encrypt and decrypt.
It is highly efficient and effective and best suited for bulk data file/database encryption and network traffic.
However, symmetric cryptography faces a significant disadvantage that is key distribution. If Alice and Bob want to communicate securely, then they need to share the key. How would they share this key? This is called the key distribution problem and troubled cryptographers until 1976.
The Revolution: Public-Key Cryptography
In 1976, Whitfield Diffie and Martin Hellman presented their groundbreaking article “New Directions in Cryptography.” In their work, they proposed an innovative idea: encryption and decryption could be done with different keys.
Asymmetrical Cryptography Mechanism
Everybody has a pair of keys: a public one and a private one.
- A public key is distributed among everybody. It is used for encryption.
- A private key is a secret key that allows decryption of messages encrypted with a public key.
Keys are mathematically related; however, deriving a private key from a public one is impossible.
It works as a mailbox. Everybody can put a letter into a mailbox (it gets encrypted with a public key), but only a mailbox owner can take out a letter from there (he uses his private key for decryption).
RSA: The First Practical Implementation
RSA was invented by Ron Rivest, Adi Shamir, and Leonard Adleman in 1977, and it was the first usable system of public key cryptography.
The security of the RSA algorithm is based on the computational complexity of factoring integers, that is, multiplying two large primes is an easy task; however, splitting their product into prime factors is not computationally possible.
The algorithm consists of
- Choosing two large prime numbers, p and q.
- Calculating N = p × q.
- Calculating φ(N) = (p−1)(q−1).
- Choosing e such that 1 < e < φ(N) and e is relatively prime to φ(N).
- Computing d such that e × d ≡ 1 mod φ(N).
- The public key is (e, N); the private key is (d, N).
The encryption formula is c = m^e mod N; the decryption formula is m = c^d mod N.
In 1977, R. Rivest, A. Shamir, and L. Adleman published a challenge ciphertext of a 129-digit number that would take 40 quadrillion years to crack. It was cracked in 1994 using a network of computers working together in parallel.
Nowadays, the RSA algorithm uses 2048 and 4096 bits for keys.
How This Revolutionized Things
Public key encryption provided the solution to the key distribution problem. Alice can now send Bob an encrypted message using his public key even though she has never met Bob before.
Public key encryption also made digital signatures possible. By encrypting using a private key, you will be able to generate a signature that can be verified using a public key. This will provide you with two forms of security: authentication and non-repudiation.
The Three Major Cryptosystems
Three major cryptosystems are used in contemporary cryptography:
1. Symmetric-Key Cryptosystems
The same key is used to encrypt and decrypt the message. Fast and effective but suffers from the problem of key distribution. Example: AES, DES, 3DES.
2. Asymmetric (Public-Key) Cryptosystems
Two different keys are used for encryption and decryption. Not so fast but resolves the problem of key distribution and enables digital signatures. Examples: RSA, ECC, and Diffie-Hellman.
3. Hybrid Cryptosystems
This cryptosystem utilizes both symmetric-key and asymmetric cryptographies. Asymmetric cryptography is used to exchange the symmetric key, and symmetric cryptography is used to actually encrypt the data. That is how TLS/SSL works—the protocol that underlies HTTPS.
Practical Cryptography: What It Protects In Reality
You utilize cryptography all the time, even without being aware of it.
When You Browse an HTTPS Site
Your browser and the server establish a TLS connection. With asymmetric encryption, they exchange keys and come up with one common symmetric key. Then, all the information, whether it is your passwords, bank card details, or messages, gets encrypted by that key. The presence of the padlock symbol in your browser indicates that this process has taken place.
When You Write a Message Using WhatsApp or Signal
These applications have end-to-end encryption. That means that your message gets encrypted on your device and decrypted on the recipient’s device only. Even the provider cannot read it. It uses the combination of public-key cryptography and symmetric encryption.
When You Use a Digital Signature
Digitally signing a document, smart-card authentication, or software update validation all use digital signatures. The software publisher uses their private key to sign the software update. Your computer validates the signature using the corresponding public key. If the signature is verified successfully, the software update is validated and has not been altered.
When You Log In with a Password
The password in plaintext form is never stored in a database. Instead, the password is hashed by passing it through a one-way function, which creates a fixed-size result. Upon entering a password, the hash of it is compared against the saved hash value. The original password cannot be restored from the hash value.
When You Use Cryptocurrency
Bitcoin, Ethereum, and other cryptocurrencies use elliptic curve cryptography to create digital signatures. Your “wallet” is basically a private key. All transactions are digitally signed using the private key, and anyone can check the signature using your public key.
Advanced Corner: Mathematical and Security Assumptions
If you wish to learn more about cryptography, take your learning to the next step here.
Computational Hardness Assumptions
Modern cryptography makes use of mathematical problems that are considered to be hard in computation:
- Integer Factorization Problem: Finding prime factors of a number that is a product of two primes. Used by RSA.
- Discrete Logarithm Problem: Given g and g^x mod p, find x. Used in Diffie-Hellman and DSA.
- Elliptic Curve Discrete Logarithm Problem: Same problem but over elliptic curves. Enables the use of shorter keys.
These problems are thought to be hard for classical computers. No proof has been found for the hardness of these problems, one of the most difficult questions in computer science.
Security Properties
What does it mean when we say that an encryption scheme is “secure”? Cryptographers provide formal security definitions:
- IND-CPA (indistinguishable under chosen plaintext attack): An adversary who is allowed to obtain encryptions of chosen plaintexts is unable to tell the ciphertexts of two plaintexts apart.
- IND-CCA (indistinguishable under chosen ciphertext attack): A stronger definition, where the attacker is also able to ask for decryptions of chosen ciphertexts (apart from the one he tries to decrypt).
Modern encryption schemes such as AES-GCM and RSA-OAEP are designed to satisfy these definitions.
Modes of Operation
- ECB (Electronic Codebook): Every block is encrypted independently. Unsecure, the same plaintext blocks result in identical ciphertext blocks.
- CBC (Cipher Block Chaining): Every block is combined using XOR with the preceding ciphertext. Uses IV (initialization vector).
- GCM (Galois/Counter Mode): Offers both encryption and integrity protection. Popular in TLS.
Hash Function and Message Authentication
A hash function accepts variable input and gives fixed output. It is a one-way function (cannot be reversed) and collision-resistant (very difficult to find two inputs having the same hash value).
Some hash functions: SHA-256, SHA-3, and BLAKE2. The HMAC (Hashed Message Authentication Code) uses a hash function and a secret key for authentication and integrity checks on a message.
The Quantum Threat: The Need for Change
This is the most significant breakthrough in the field of cryptography.
Shor’s Algorithm: The RSA Cracker
In 1994, Peter Shor devised an algorithm that could factor large integers and perform discrete logarithm computations exponentially faster using a quantum computer compared to any classical computer.
This means that RSA, Diffie-Hellman, and ECC, which form the basis of internet security, would be easily cracked.
Grover’s Algorithm: Breaking Symmetric Cryptography
Grover’s algorithm gives a square-root speedup in performing the search algorithm. When it comes to symmetric encryption, this means that it would reduce the length of the key by half. An AES-256 would only give the same security level as AES-128.
The solution here is simple: double the key size. AES-256 would remain secure from attacks using Grover’s algorithm. But when it comes to asymmetric cryptography, the problem cannot be solved so simply. The problem itself becomes trivial.
Harvest Now, Decrypt Later
This is where it gets truly scary: today, hackers collect your encrypted data, store it, and wait until the quantum computers become sufficiently advanced.
Your encrypted messages, bank data, and other communication channels will be decrypted in 10 or 15 years. However, when the information you send has to stay classified for decades, it becomes urgent today.
When Will Quantum Computers Be Ready?
Scientists have recently revised their estimates and cut down the required number of qubits to break RSA encryption. In 2026, one research study found out that by applying new error-correction methods, breaking RSA would need just tens of thousands of physical qubits instead of millions.
Some scientists believe that cryptographically relevant quantum computers will be built somewhere between 2028 and 2033.
Post-Quantum Cryptography: The Answer
Post-quantum cryptography (PQC) are those algorithms that are computed classically but secure against attacks of both classical and quantum computers.
In 2016, NIST held a worldwide competition for PQC algorithms. In 2024, the first standardization is expected to come out.
The Key PQC Algorithm Classes
Lattice-based cryptography: based on the difficulty of solving the problem of the shortest vector in high-dimensional lattices. Dominates the race because of its performance and sound theoretical bases. Example: CRYSTALS-Kyber (key encapsulation), CRYSTALS-Dilithium (signatures).
Code-based cryptography: uses error-correcting codes. The McEliece cryptosystem was proposed in 1978 and has stood up to analysis for decades. Problem: huge public keys.
Hash-based signatures rely only on the properties of hash functions. Safe and reliable. Example: SPHINCS+. Drawback: huge signature size and slow signing.
Multivariate polynomial cryptography relies on solving systems of multivariate quadratic equations. Small-size signatures but subject to cryptanalysis (for example, the Rainbow scheme was cracked).
Isogeny-based cryptography relies on elliptic curves’ isogenies. SIKE was one of the leading candidates but was cracked in 2022.
NIST Standards (2024)
- ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism): Derived from CRYSTALS-Kyber. Used for key exchange.
- ML-DSA (Module-Lattice-Based Digital Signature Algorithm): Derived from CRYSTALS-Dilithium. Used for digital signatures.
- SLH-DSA (Stateless Hash-Based Digital Signature Algorithm): Derived from SPHINCS+. Fallback signature algorithm.
Migration Deadlines
- NSA: National Security Systems should migrate by 2033.
- EU: High-risk systems by 2030.
- G7: Similar compulsory migration deadlines.
Migration represents an enormous technical task. All hardware, all protocols, and all applications that use cryptography have to be updated. Hybrid solutions, combining classical and post-quantum cryptographic algorithms, are currently used in the process of migration.
Common Pitfalls and Misconceptions
“Cryptography is only about encryption.” While encryption is a critical component of cryptography, it also offers other services like integrity, authentication, and non-repudiation.
“AES is unbreakable.” AES is safe only if properly implemented. Side-channel attacks, poor key generation, and faulty implementation are genuine risks. While the algorithm is solid, its implementation can be flawed.
“I have nothing to fear from quantum computing.” In case your information has to remain confidential for over several years, you do. Today’s harvest is now, and decrypting later attacks is a reality.
“The larger keys provide more security.” While the key size is crucial, the design of the algorithm is even more important. Bad algorithm design makes even lengthy keys worthless.
“Cryptography is an expert topic.” While you may not design any algorithm, knowledge about them would help you to make better choices.
Next Steps to Take
Individuals:
- Use encrypted messaging apps (Signal, WhatsApp) when discussing anything sensitive.
- Enable HTTPS wherever possible (most browsers do that automatically nowadays).
- Password managers make sure everything is done cryptographically right for you.
- Ensure you use up-to-date software updates made with cryptography in mind.
Developers:
- Don’t ever write any cryptographic algorithms yourself. Use reliable libraries instead.
- Encrypt everything using AES-GCM or ChaCha20-Poly1305.
- Use RSA-2048+ or ECC (P-256+) in asymmetric cryptography, yet be prepared for PQC migration.
- Use bcrypt, scrypt, or Argon2 for password hashing; never use raw hashes.
- Adhere to NIST recommendations and follow the PQC standardization process.
Organizations:
- Identify all cryptographic assets and know which algorithm protects which data.
- Evaluate your risk from harvesting attacks followed by decryption.
- Create a PQC migration plan, starting with the most valuable data stored for a long time.
- Test hybrid solutions in a non-production environment.
- Stay up to date with NIST and industry recommendations.
Bottom Line
Cryptography is the backbone of digital trust. From the rods of Sparta to Caesar’s shifts, cryptography has come a long way as mathematical equations to secure the transactions of the world. However, it is not stationary; rather, cryptography is going through its biggest migration due to the quantum attack scenario. Cryptography algorithms that have worked well for years need to be changed.
It is no longer limited to IT specialists only; knowing about cryptography, its functioning, and evolution has become one of the basics of digital literacy today. The best part is that there are solutions available for the same. The tough task is implementing them, and that is happening right here and right now each time you click on the lock icon of your browser.
Disclaimer: The material is intended for learning purposes only. Learning cryptography enables you to use security tools in an efficient manner and take sound decisions. Always adopt responsible measures and adhere to privacy laws while using cryptographic tools.
Explore Our Cybersecurity Category. And if you are reading it up to here, leave a sweet comment to motivate us to write blog everyday.
