Cryptography in Digital Forensics

The origin of cryptography has been found to date back to about 2000 B.C., with the practice of hieroglyphics by the Egyptians. ‘Crypt’ means secret or hidden and ‘graphy’ refers to writing. It is a method of protecting information or data through the use of codes, so that only those, for whom the information is intended can read and process it. It is thus considered to be a science of protecting information by encoding it into an unreadable format.

The modern cryptography was first used by Julius Caesar, in which each character in his message was replaced by the character three positions further down the Roman alphabet. It is also known as Caesar Cipher. Let us look at an example which shows a standard alphabet and a shifted alphabet. The alphabet serves as the algorithm, and the key is the number of locations it has been shifted (which is 3 in this case) during the encryption and decryption process.

Standard Alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ

Shifted Alphabet: DEFGHIJKLMNOPQRSTUVWXYZABC

For example, in order to encrypt the message or the Plaintext “MURDER”, we take the first letter of this message, M, and shift up three locations within the alphabet. The encrypted version of this first letter is P, so we write that down. The next letter to be encrypted is U, which matches X when we shift three spaces. We continue this process for the whole message. The final encrypted message or the ciphertext would be “PXUGHU”. Today, this system would be considered rather ineffective. Nevertheless, complexity of cryptographic algorithms have been highly increased over the years and it has come a long way since.

The basic concept, however, is that, we start with the normal message or the unencrypted data, known as the plaintext. This plaintext is then encrypted into ciphertext, which will in turn (usually) be decrypted back into usable plaintext.

The encryption and decryption is based upon the type of cryptography scheme or the algorithm being employed and some form of key. This cryptographic process can be written as:

C = Ek (P) P = Dk (C)

where P = plaintext, C = ciphertext, E = the encryption method, D = the decryption method, and k = the key.

Although, one of the main objectives of cryptography is to hide information or data from unauthorized individuals, however, with enough time, resources, and motivation, it is possible for hackers to break most algorithms and reveal the encoded information. Therefore, a more realistic goal of cryptography is to rather make the process of breaking the encryption too work-intensive or time consuming to be worthwhile for the attacker.

Terminology

• Cryptography: It is mostly concerned with the development and creation of the mathematical algorithms which are used to encrypt and decrypt messages.
• Cryptanalysis: It is the science of analyzing and breaking encryption schemes. In other words, it is the practise of uncovering flaws within the cryptosystems.
• Cryptology: It is the the broad study of codes or secret writing and encompasses both cryptography and cryptanalysis.
• Plaintext: It is information that can be directly read by humans or a machine, where no attempt of concealing the message is made, i.e., the unencrypted data.
• Ciphertext: It is the data, which has been made unreadable or meaningless to others through the use of an algorithm, so that it cannot be processed or understood until it is decrypted. In other words, it is the encrypted data.
• Cipher: It is the mathematics or algorithm which is responsible for turning plaintext into ciphertext and reverting ciphertext to plaintext.
• Key: A cryptographic key is a string of bits (computer data) used by a cryptographic algorithm or cipher to transform plaintext into ciphertext or vice versa.
• Keyspace: It is a range of values which can be used to construct a key. When the algorithm needs to generate a new key, it uses random values from this keyspace.
• Cryptosystem: It is a system or product that provides encryption and decryption and can be created through hardware components or program code in an application. It encompasses all of the necessary components for encryption and decryption to take place such as the software, algorithm, keys, etc.
• Encryption: Encryption is the process of converting normal message (plaintext) into meaningless message (Cipher text).
• Decryption: Decryption is the process of converting meaningless message (Cipher text) into its original form (Plain text).

Functions of Cryptography

There are five primary functions of cryptography today:

1. Privacy/confidentiality: Ensuring that no one can read the message except the intended receiver.
2. Authentication: The process of proving one’s identity, i.e., the sender and receiver can confirm each other’s identity.
3. Integrity: Assuring the receiver that the received message has not been altered or changed in any way from the original.
4. Non-repudiation: A mechanism to prove that the sender really sent this message, such that the creator/sender of the information cannot deny at a later stage that he did not create/send the information.
5. Key exchange: The method by which crypto keys are shared between sender and receiver.

Let us look at an example of how these functions are satisfied. Suppose your boss sends you a message telling you that you will be receiving a raise that doubles your salary. The message is encrypted, so you can be sure it really came from your boss (authenticity), that someone did not alter it before it arrived at your computer (integrity), that no one else was able to read it as it was transmitted over the network (confidentiality), and that your boss cannot deny sending it later when he comes to his senses (nonrepudiation).

To read about types of Cryptography in detail , check out our next post- Types of Cryptography