Cryptography: Everything You Never Wanted to Know

What is Cryptography?

Ever since humans first started using written language, they’ve been keeping it secret. Not the writing, itself, obviously, but the messages contained therein. “Cryptography” — the practice of keeping messages private in the face of adversaries, often with coded text — has been a fundamental concept since hieroglyphics, some 4,000 years ago.

In today’s fast-paced world of digital communications and payment systems, cryptography has become essential to ensuring data security.

Cryptography is the heartbeat of keeping your and your customers’ data safe, your communications with online payment mechanisms secure, and mission critical secrets for enterprise and government, well, secret. It’s essential to the triad of confidentiality, integrity, and availability (CIA), a common model that forms the basis for the development of security systems, and even to saving lives!

Not only is cryptography the super cool science of keeping secrets, but it extends its reach into mathematics, science, technology, politics, and human rights. At Salesforce, it helps us live up to our number one value of Trust. And it’s also one of the biggest buzzwords in tech, right along with cryptocurrency and NFTs.

There are also concerns of existing cryptography standards being broken in the future due to — get ready for some jargon — post-quantum cryptography, where the overhead of cryptanalysis is drastically reduced, meaning it may be possible to break some cryptosystems. We’re still quite a while away from that so don’t get too worried…yet. We’re gonna cover what has been and what is first.

Every superhero has an origin story

Cryptography has saved lives throughout time. Unfortunately in some cases, the opposite has been true, where broken cryptography has led to dramatic, moribund events. For instance:

The Caesar Cipher

The Caesar Cipher is a cipher (a set of rules or a combination of two or more algorithms) named in honor of Julias Caesar. He used it to encrypt military and official government messages. Using a transposition of three, the plaintext is rotated by three letters down the alphabet to produce the fixed output of ciphertext. So the words “trust” has the ciphertext output of “wuxvw”. W is three letters down from T and so on.

The Babington Plot

In the year 1587, Mary, Queen of Scots, was imprisoned and watched under lock and key. Finding it nearly impossible to communicate with the outside world, she was able to create her own cipher consisting of a nomenclature (letters and symbols) and send them to her allies by smuggling parchments with the code through beer barrels. Eventually this was cracked by a method called frequency analysis (identifying the most common ciphertexts and guessing what they would attribute back to) and Mary’s plot of treason against Queen Elizabeth was met with a grim fate. Had she rotated her nomenclature more frequently, it may have saved her life. 

The Enigma Macine

During WWII, the German military used this mechanical cryptographic device to encrypt messages and make them undecipherable to unintended snoopers. Think of a typewriter stuck in a box with multiple rotors attached. When you would press a key, a light would appear on the end of the board highlighting a letter. The intention of this was that every time you pressed the letter “A”, you wouldn’t get the same letter twice in a row as the mechanical wiring of the box would change due to the rotors changing how the keys would output text. Alan Turing eventually cracked the device. It’s believed that the cracking of the enigma machine ended WWII early and saved countless peoples’ lives.

Let’s look behind the mask

Now, you might be wondering what all this has to do with you and your data. It’s important to understand how the different eras of cryptography eventually led us to how we communicate securely on the internet today and how we protect ourselves against threat actors. Not only is it technology, it’s a fine art we must be grateful for in today’s cybersecurity world. It’s also important to understand some basic terms when diving into a super complex subject. Some basics that will help you go from zero to cryptographic hero:

1. Plaintext: A message in its pure original form

2. Ciphertext: Altered form of plaintext message, unreadable to anyone except the intended recipient, also known as a cryptogram

3. Cipher: A series of well-defined steps that helps implement encryption; a cryptographic algorithm, also known as an encryption engine

4. Encryption: The art of turning plaintext into ciphertext; putting plaintext through the encryption engine

5. Decryption: The reverse process of encryption

6. Key: A crypto key is a string of bits used by a cryptographic algorithm to transform plain text into ciphertext; controls the operation of a cryptographic algorithm, also known as a cryptovariable

7. Key Space: Total number of possible values for a key in a cryptographic algorithm or other security measures such as a password. Thus meaning, a four digit number like a PIN would only have a key space of 10,000. The numbers 0000 – 9999. 10,000 possible guesses.

8. Hash: A one way variable input mathematical function which produces a fixed ciphertext output. More on this later in the blog. 

Hidden in plain sight   

Today, the algorithms and keys we use on the Internet are pretty much everywhere, unless you went out of your way to disable your security. Presuming that you’re reading this through a browser, you should notice a lock symbol in the left-hand side of your search bar. The symbol denotes that your connection to the web is secure. The security is put in place using, you guessed it, cryptography. 

That protocol is Secure Sockets Layer/Transport Layer Security (SSL/TLS) and is what we use to encrypt Hypertext Transfer Protocol (HTTP). It allows us to transmit information over the internet and populate information to a website. This can be both metadata and values you add in fields, like passwords and credit card information. However, since it’s in plaintext, anyone can see it if snooping. By negotiating with the website using Public Key Encryption, we can use the website’s certificate to then create an encrypted and authenticated channel of communication. You can verify that the Public Key belongs to a website by validating it against what is known as a Certificate Authority.

Keys to the universe

You can have the strongest algorithms in the world but your key is the mechanism that locks and unlocks it. If anyone were to get your key, they could decipher all of your communications. The key is the heart of cryptography and keeps it secure and private. It ensures your crypto systems are in good standing. 

Symmetric keys

When I want to encrypt something at rest, let’s say a large volume of data sitting on a disk, I would use a symmetric key. One key to rule them all. This means I have the same key that does the encryption and decryption operation. Symmetric encryption is great for bulk and resource-heavy encryption (think terabytes of information). Some algorithms/ciphers we use today for symmetric key encryption would include DES, 3DES and AES. So when protecting customer data, we would use these types of algorithms to keep you and your customers’ data safe. I use the plaintext, I put it through an encryption engine (the cipher/algorithm), I put my key into the engine, and that enables the cryptography to take place. Just like starting a car, the key is needed to turn it on. 

Now we have looked at encrypting data at rest. What if I want to communicate with you via the wire and I need to send a key to you? Surely if someone were to snoop on that communication gateway they could see the private key? Yes, they could. There are some ways around this and thus we enter the world of public key encryption. 

Asymmetric keys

With symmetric keys, there is one key to rule them all. With asymmetric encryption, there are two keys to rule them all. This is more resource-intensive due to higher computational overhead. One is a public key, which means the whole public internet can see it. The second is your private key that only you, and you alone, should ever be in possession of. The decryption process takes place when the two keys are matched.  

Let’s say I wanted to send you an encrypted message over the wire. I would first reach out to you and get your public key. With your public key, I would then encrypt the message I intend only to be sent to you. So again, everyone will have your public key but they don’t have access to your private key. No one can decrypt the message except the holder of the private key. 

Ok great, now I know how to encrypt. But how can you trust a message actually came from me? 

Hash it out

Why don’t we switch around the key usage? I want to prove I sent you a message and provide integrity along with the message. After all, someone at the end of the wire could be pretending to be someone else. So before I send you an encrypted message, you ask for me to verify the integrity of it. This time, I will sign the message with my private key. Remember, I am the only one who possesses my private key. Surely if I use it to sign my message, it must come from me right? 

When we sign a message here, what we really mean is we sign its hash. A hash is a one way variable input mathematical function that produces a fixed ciphertext output. This is known as a message digest. So for example, if the message were to state “Salesforce Rocks!”, the hash would look like this: 

cb3f2a6595c407552a961a9bb661371b62bea1dc55732eb032c2f5a49bf84272 

I’ll calculate my digest and then encrypt it with my private key, thus creating what’s known as a digital signature. When you receive the hash from me, you can match my public key against it and see that it matches. The hash changes if the message is intercepted at any stage. For example, our snooper doesn’t like capital letters and decides to intercept and change the message to “salesforce rocks!”. The fixed ciphertext output would be completely different and look like this: 

80c7f510141d090a37b2865284fbe3593a911d9f81bcd2d80b5e2cc845e0dfc2

When you receive the message, it would be different from what was originally signed. The signed digest would not match the received digest. This means non-repudiation (the ability to not be able to deny) would not be possible — you couldn’t trust the sender or the integrity of the message itself. The change in hash values from a minor change to the original plaintext is known as the crypto-avalanche effect.

Public key vs. private key

We can be secure in our transmission by having someone sign the message with their private key and then use the recipient’s public key to encrypt the message. Thus full asymmetric encryption is at play and your communication channel is secure and verified. Asymmetric encryption is used in every communication pathway you have on the internet to ensure you can trust the end recipient. Some examples of asymmetric encryption algorithms would be RSA, DSA, and Elliptic Curve.

Asymmetric encryption can be resource-intensive. So, we have what’s called “hybrid cryptography”, which is when the sender generates a symmetric session key, also known as a shared key. Before sending that key, they’ll take the recipient’s public key and encrypt the session key. They then send it over the wire encrypted with an asymmetric key. The recipient decrypts with their private key and voila, encrypted communication can take place using the session key (e.g. 128 Bit AES). This allows both parties to perform faster symmetric encryption.

Certifiably secure

Cool, right? Only, how do I know someone’s public key is actually their public key? Remember that key the recipient requested above so we can encrypt the message sent to them. Welcome to the world of public key infrastructure (PKI) and certificate authorities (CA). Think of PKI as the invisible cryptographic backbone to your communications online. CAs are essentially third-party cryptographic verification bodies which validate that a person’s public key belongs to them. This takes place using digital certificates. 

When you complete a course, you receive a certificate from the educational body with a stamp stating “person A is hereby certified by this institution”. Similarly, a digital certificate contains your public key and is issued by a trusted third party, essentially saying “Yes, this public key belongs to Person A.” 

Have you ever gone to a website and it states, “warning do not enter here, there is an issue with the certificate”? That’s because the entity doesn’t have a certificate that can be validated by a trusted third party. There’s a lot more to the secret sauce than what has been mentioned here, but this is a high-level overview to give you some basic understanding. 

You get a cape, we get a cape

What does all of this have to do with you and Salesforce? Well, cryptography is what helps us keep your data safe and your communication channels secure. Amongst a myriad of security measures, Salesforce ensures customers’ data is safely kept in rest and in transit. We have ways of making sure keys are safe and secure — Hardware Security Modules (HSM). These are special pieces of cryptographic hardware which store cryptographic keys and adds an extra layer of security. It allows us to compute the cryptographic keys on these devices rather than let them sit in a file in our servers. Next time you have bulk data lying about, make sure to encrypt it. If you are communicating with someone on the wire about super secret confidential information, use public key encryption to ensure you do so securely and with integrity. Don’t forget — cryptography saves lives!

Learn more

Are you aspiring for a career in cybersecurity and want to know more about cryptography? I would highly recommend doing some deep learning on PKI and cryptography. You can find great resources on YouTube like these videos from Neso Academy and Pico Cetef (look up concepts like Kerckhoffs Principle). Check out a book called Serious Cryptography: A Practical Introduction to Modern Encryption for a deeper dive into how computational cryptography works, block ciphers versus stream ciphers, and more. It’s also worth looking at one of the original public key algorithms (though some would say it’s a symmetric key exchange using an asymmetric framework), the Diffie-Hellman Key Exchange.

Most cybersecurity courses will have modules on secure communication too. There’s also the concept of steganography, which means hiding the message in plain sight (one could sneak all the works of Shakespeare into a picture of a dog). Steganography can be the enemy of data loss prevention (DLP).