Week two of an undergraduate course on the Dark Side of the Net taught at the university of Winchester.

1. MC3003
Dark Side of the Net
Lecture 2
Cryptography

2. Introduction
• This week we are going to be considering the study of secret writing -
cryptography.
• Cryptography is central to contemporary computing and ecommerce would
be impossible without it.
• We are only going to offer a very cursory examination of it here – you can
do whole degrees and Master’s degrees in it.
• We will cover some technical issues but will stay away from too much the
mathematics which underpins it all.
• Aims:
• Introduce key terms in cryptography;
• Look at how a number of ways a cipher can be ‘attacked’;
• Provide and overview of contemporary Public Key Encryption used widely on the
internet;

3. The point…
Secret writing
Steganography
(hidden)
Cryptography
(scrambled)
Transposition
Substitution
Code
(replace words)
Cipher
(replace letters)
• The aim of cryptography is to be able to convey a message to
someone else without a third party being able to intercept it.
• It is one of a number of branches of ‘secret writing’

4. Basic terms -The common language used in
discussion of cryptography.
• Plain text – the message that we are going to send.
• Channel – means by which the message is sent.
• Cipher text – the text once it has been encoded.
• Cipher – the algorithm used to encode and decode. Similar to code (however codes are
not technically attempts to hide meaning just convey it in a different manner – computer
code or morse code).
• Encryption – the process of turning plain text into cipher text.
• Decryption – the process of turning cypher text back into plain text.
• Key – the information used in the cipher - it might be the specific instructions or
settings of a cipher
• Alice – the person who sends the message.
• Bob – the person who receives it.
• Eve – the person who tries to intercept it.

5. Encrypting / decrypting
This is a top
secret
message.
Plain text Cipher with Key
Mabl bl t
mhi lxvkxm
fxlltzx.
Cypher text
Encryption
This is a top
secret
message.
Plain text
Mabl bl t
mhi lxvkxm
fxlltzx.
Cypher text
Decryption
Cipher with Key

6. Alice
Bob
Eve
Chanel
SIODHCIAUSDFV;ANVPAJHPAIHVP;AJSDHPIAN
K;VIAHVKJNKJHAIHDHLAIHVAI;KHVIPAUHVPAI
UHVAOIASDAV
Plain
text
Plain
textCipher
+ key
Cipher
+ key
Encrypt
Decrypt
Cipher text

7. Cipher
• A cipher is the system used to
encrypt a message.
• There are many different
ciphers.
• Most can be set up differently
and some have innumerable
settings.
• They often require additional
information, known as the
key, to make possible
decryption.
Vigenère Cipher developed in 1586 (an important
year). The key is a word. This is used to choose the
which columns are used for each letter. If my key
was “Winchester” and I am encrypting “student” I
look up the column W and the letter S = O, the
column I and letter T = B etc…

8. Symmetric ciphers and keys
• Until fairly recently nearly all ciphers were symmetric use
the same cipher and key to encode and decode the cipher
text.
• They allow quick and easy encoding and decoding.
• They can be impossible to crack – see one time code pad
later.
• However, - from Alice and Bob’s point of view- a major
weakness of symmetric ciphers is that the cipher, the
cipher text and the key must be conveyed to the person
receiving the message and they can therefore be
intercepted.
• The cipher text is no problem and the cipher itself is also
not too bad, but the key is important.
• This is known as the ‘private key problem’; the key will
unlick the message and both Alice and Bob need it.
• If Eve gets hold of the key she can unlock any messages.

9. Weaknesses of symmetrical ciphers
• Eve’s job is hard.
• She can intercept the message and she may know the cipher – there
are many types of cipher but they are in families, skilled cryptanalysts
can identify the family and given time the specific cipher.
• However she may not know the key.
• She has a number of possible strategies:
1. She can ‘brute force’ the key –figure out the key through trial and error.
2. Use various mathematical techniques, such as frequency analysis.
3. She can try to develop a ‘crib’- identify a clue that may give one small hint of
the key away.

10. Examples - cracking a Cesar cipher…
• Julius Cesar is thought to have used these.
• It is a simple ‘substation cipher’ one letter
is replaced with another.
• Often uses a chart or wheel to arrange the
letters.
• The key is the number of turns of the
wheel.
• Used widely even until the 20th century.
• Not very secure.
Confederate wheel – the key would be
the ‘setting’ – how many turns - the
wheel has been set to. This one is set
to 4 so A = D.

11. Example 1 Brute forcing a Cesar cipher
• Cesar cipher work by substituting
one letter for another.
• There is a shift but we don’t
know how many letters we have
shifted.
• We can force it out by keep
trying one small section.
• There can only be 26 possible
combinations so it is manageable
with a bit of time and once the
key is discovered it is easy.

12. Activity
• Here is a well known phrase
encrypted using the Cesar code.
• Use brute force to work out the
key and what the phrase is.
• wrehruqrwwreh

13. Example 2. Attacking a Cesar cipher with
frequency analysis
• The problem with such codes is that
they can be easily broken using
frequency analysis.
• We know what frequency letters
appear in English words.
• E is the most common letter.
• We can look at any encoded
message and look at what letters
appear the most.
• We then compare that to our
frequency chart and very quickly we
can see what substitutions have
occurred.

14. Activity
• Here is some top secret text that I intercepted.
• I know it is in Cesar code but I do not know the key.
Ymnx rtizqj bnqq htsxnijw fxujhyx tk nqqjlfq fhynanyd tsqnsj fsi jcuqtwj mtb ny fkkjhyx ymj
sfyzwj tk tsqnsj fhynanyd. Ny bnqq htsxnijw f szrgjw tk yjhmstqtlnjx fsi uwfhynhjx ymfy fqqtb
ujtuqj yt htsizhy fhynanyd ymfy nx nqqjlfq tw fy gjxy ijanfsy. Ymj htzwxj htrrjshjx bnym f
inxhzxxnts tk ymj xhtuj tk ymj fhynanyd htajwji. Ny nijsynknjx ymj xzgojhy tk xyzid fx f xzgxjy tk
ljsjwfq nsyjwsjy hzqyzwj fsi iwfbnsl zuts nijfx kwtr hzqyzwfq hwnrnstqtld nijsynknjx ymj fhyntsx
tk ymnx xzgxjy fx ijanfsy wfymjw ymfs hwnrnsfq. Ymj htzwxj ymjs htsxnijwx f szrgjw tk xujhnknh
yjhmstqtlnjx zxji yt fqqtb ktw xzhm fhyntsx yt thhzw. Ymjxj nshqzij: hwduytlwfumd, fstsdrnyd
xtkybfwj (nshqzinsl ymj YTW gwtbxjw) fsi Gny htns fsi tymjw hzwwjshnjx. Xzhm yjhmstqtlnjx
fwj sty hwnrnsfq tw ijanfsy ns ymjrxjqajx gzy it ujwrny ymj fhynts ymfy rfd gj hmfqqjslji fx
ijanfsy tw ijjrji nqqjlfq ns hjwyfns ozwnxinhyntsx. Ymj htzwxj ymjs rtajx ts yt htsxnijw f szrgjw tk
xujhnknh fhyntsx fsi uwfhynhjx ymfy fwj tkyjs htsxnijwji hwnrnsfq tw ijanfsy: ymjxj nshqzij,
xufrrnsl, mfhpnsl fsi ymj ywfnsnsl tk nqqjlfq lttix. Zuts htruqjynts tk ymj rtizqj xyzijsyx bnqq gj
fgqj yt pstbqjiljfgqd inxhzxx tsqnsj hwnrj fsi f szrgjw tk ymj pjd bfdx ns bmnhm ny nx jsfhyji.

15. • Open:
• http://www.counton.org/explorer/codebreaking/frequency-analysis.php
• Paste the cipher text into the box and execute.
• This will give you the frequency that letters appear in your text.
• What can you do with this to figure out the key?
• Once you have the key, open:
• https://www.dcode.fr/caesar-cipher#1
• Insert the cipher text and using the key you have deduced decode the
message.
• This approach first developed in 9th century.
• However it was defeated with the Vigenère cipher.

16. The problems of weak ciphers –
Mary Queen of Scots...
• Mary Queen of Scots planned to have
Elizabeth 1st assassinated and hid her
messages using a version of the Caesar
cipher with symbols substituted for letters.
• Messages between her and other plotters
were intercepted and broken (but allowed
to go through).
• She denied the accusation but the cracked
messages were used in court and she was
executed in 1586 (same year as the
Vigenère Cipher was invented - The
Vignère Cipher was not cracked for another
250 years and then the solution was not
published until the 1970s.

17. Example 3 Cribs
• The Enigma Machine in WW2 was very difficult
top crack.
• It was used to by the German army and submarine
service during WW2.
• Continually advanced and each advance required
significantly more investment to crack the ‘upgrade’.
• One major crack was the use of a ‘crib’ – this took
advantage of a weakness (not in the machine but in
the process and way it was used).
• If you could be certain a certain phrase would be used
you could try and find that in the message.
• Wetterforsage.
• https://www.youtube.com/watch?v=yFI__VYz3ko
• Then reverse engineer from that other parts of the
key.
Even when it had been captured the
Enigma machine had
15,000,000,000,000,000,000
(fifteen-thousand-quadrillion)
possible settings. And the they
changed them every day.
It was eventually broken with a crib
and a computer.

18. Post war developments.
• The developments of computers used
to attack the Enigma cipher and other
German ciphers made a major
contribution in the development of
computers.
• The Colossus (pictured) is thought to be
the first programmable computer (not
used on Enigma but other codes).
• Theses computers led, eventually, to
the development of contemporary
computers and the consequent use of
encryption.

19. One time cipher pads
• One method that has proven unbreakable
is the use of one time code pads.
• Pairs of unique books were made, each
pad was unique
• The key is completely random and only
used once.
• Need to know which pad is used (done by
date or message number).
• Down side is that it is fairly damming to be
found with one of these and a cipher…
• https://www.khanacademy.org/computing
/computer-
science/cryptography/crypt/v/one-time-
pad
Russian one time
cipher pads from
1960s.
British wartime message
written on a OTCP, found on a
dead pigeon, now
undecipherable

20. Why do we need encryption today?
• Early internet communication was between scientists and academics
for whom privacy was not a priority.
• Ironically (given that the early internet was in part at least partially
developed by the US military) one of the underlying principles of the
internet has been its openness.
• However, such openness is not much use if you want to buy things,
trade things or just not have your email and web use monitored you
need to find a way to make them secure.

21. Modern cryptography
• Is computer based and makes use of high level mathematics.
• Main development is to find a way around the problem of the private
key.
• Some way of being able to send a message to some one only they are
able to decode.

22. Public key encryption.
• The answer developed is called public key encryption.
• This system involves developing a new kind of cipher and key.
• In this approach the key is derived from an advanced form of
mathematics and comes in two parts.
• One part of the key is used to encrypt the message and the other part
is used to decrypt it.
• This is known as asymmetric cipher.
• The two parts are the public key and the private key.

23. Public and Private key - email.
• Use a special computer program / plug in Bob generates a set of keys.
• One is public and the other private.
• Bob posts the public key is posted to the internet and is stored in
many places.
• Bob retain the private key on his email account or computer.
• When Alice wants to send Bob a private email she encrypts it using
the public key and send it to Bob.
• Bob am the only person who can decrypt it.

24. Public Key
Internet
He publishes the
public key and
retains the
private one
Bob
makes a
two
part key
Alice downloads and
uses Bob’s public key
to encrypt a
message.
Bob uses his private
key to decrypt the
message back into
plain text.

25. What does it look like?
• This is mine, it is in an email signature or on a server.
• It only works on email accounts that allow for encryption. The Uni one does not.
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: Mailvelope v2.1.1 Comment: https://www.mailvelope.com
xsFNBFpiOxsBEACnhowLzdjCL7Y2Ro+4hhRxv7BeOQJh5B3MK42nFLoRTnXC K0GSyyDIpLA+3PrIWNgcj1kabKYPatiRkXrLHAg9CakKOG8BINqsxGZplpG5
kEjTi+uuHnDKLbPylxmR+mhiPNb35GQyMmvBqy3wVl++Hi1Fd0JQNbvJz/eK U9SVbzVBlHfOU9TK6dQoeZiDYEHVTONFtTojOFlwxjSe10GjwmNGi4Gx8kk4
lwRoqC9DskMjLIeZcXZXeQyZHg1Hk9dGyFNDK57gOIJ+ETUXqWtudDYo+N+5 PXAlxEqof/ZUd/ZmhPN9CFPkWnaOiO9y3473GVQUYSzPUm2nbkEY19yW8GS2
r5bGdCvIlA1h6KMIEoVRBnCa4b5XSfcLgOIzeFegOP4bwq+0nHjqONyeVw2v zMYwf8NWM1UKZdbxJXbmCMHMrduyF4dekjUtmyl17919Qh3V4J9PF3ZZVhDp
vbBIyx9UVBBePFbXvy2yYJGfaRKXCY31Jsp9a9OARZOpNajTKuZZN+JdC43G 8nNQPu4teuVK6csJ2bMaaU7pEboG5Wcay7fkHuH9gKGba/3f7xzN/hqiTukB
WL9szss6kzaXymVq7OyrPb5+Ajmp1MccE3UlfJvfhynaesMu1dxW8M1FNGME CtTX8gK/DPui5wIMPMw9qwHXq9PyneGVp7QbyQARAQABzS9tYXJjdXNsZWFu
aW5nIDxtYXJjdXMuYS5sZWFuaW5nQGdvb2dsZW1haWwuY29tPsLBdQQQAQgA KQUCWmI7HAYLCQcIAwIJED8kbhC4EVe/BBUICgIDFgIBAhkBAhsDAh4BAABz
Kg/8ClpqiUC0k5m6UewcJTdlnyJ3rid0EuOaLxbhLne7CNy+fkDOzk4qPxrW 2o+2/YOoWEjz5mVxYd58UtJl3NVjRfWD5NGnAjofzIQNQYACLj6rCvMiZobM
GyEZYEU0i0pVdW+8xWBULHfajUBLoU69bEoqwtrqKUriy5U0C7cZAlMLAjCU V2a432DABqowy2W5QdgtPmeffOdtxmtObVDntzO7p4121J1Ciwa/oZX0f6jp
EMSwvJc8stomexU8295UGkVkJjEqvhQsrSphJ+k6ocufnx6LU8UNBavJe/qO 9m+EkiYclnYKIDMfnvT4Urhjvx6y94J9we2PrvT2b153Axq4/aGqST9nf0NL
urCh64EMLbtcMID5Iln6mfO3VFHSlA10Ggpo8BryP/CqnGKiE3evoInmgXzw 39Aa4n1H3VSc2Wmejb0fwvl50LfJIpsSJUWSmwmtEUw87i10NFza1GCJS6c7
qzk4rz2df2rYAbaKKrfTjlkRdcpenXnhsJB1F8AC5gvwkF2NA35v5bf5q6fN xa48wBZmSMbK2DoaaeZRJpHRsXyQLT6StWbCNJiMGt8FUKWn0vrvUjJEWeJS
Ox8W8TjFzzdwNoEmrtJ9VH2WlggzfxVyV5IavcKdIkvmzE1z50bRQT6XBTfL fAaHR8LU1RFpVnKLaOQtIlsnsBvOwU0EWmI7GwEQAJWZwa2mhx53IYQ5lB0L
zAhj4TcDqA5UJG4Bkl2lZwRaGvEbMf1byCOAJ3YzsU0ngb9roXUZzd2oAONV BNALHD149V2w/ZZ+JJrHfdy+kMm6+Ulrk3X+YcKvA8XCYfY4kX9NmaHcIzza
ArQ/x+jqwxFmr78eOoOUL3l/W1g6hpt6Hka1i+y9Lh6JxYUh1lykDoTMKGJs hEHVh+/RDhFdoN97ysQMhAybGQQ1WwAtba2jsSOtcsKIpEAUjesyyoUhvSAW
dS7hNA3TGDjL3dWhhS0N7PqhtInrdqMhyolJiorxJpUXzDvJ03Jo1Xi3qffr GOuSWj5ckYMDJJFe+ujKKOcr+NMVp64aA1hneatGPxcFsMzAr5ka9O6duBq+
4T30CGl4yNNU/5x/lKqGjEiBDWcb3LrpLavQnYUmT0qlynM1q1N2prIFqflt iXaLVMOH/tjYWXOTlmnk1T0QeM7u5ucr40cMyYwgie2AKno2hfQHoRA862Mg
5lHKxo4YglCVkPWBJrxZE68m8dGx4e+NfatKY3fFxwLD1wiOG+0JLN07d3pv lTvt0uplggYh619qpo18mIfPN/YFiFznDjRH4uMZ8/R0Eu+l6kNYAoe0l1Zu
Lae7MbEBKA8G6oT+yLgHljxHGIIFc2egAb4P1Xks0NOzf6dpnPUlpy2MfEO2 wDxhABEBAAHCwV8EGAEIABMFAlpiOx0JED8kbhC4EVe/AhsMAADi0w/8DYU2
CvvD8ULIjrWLVEH7667eRyTrsRhQA4m9HJmcGFsG2GPQ13XQhONErZ4v9gvl EecE8XlQ09w9gdyrBUxwDQJ4DowgGUQhXO0J/V0ZBwdrxxp3d75aE/6mZLCB
3MvbX74hQtyaRz5o7QPBkJRUSwWGR/Q7TArkXs5FXpPM8APvk8xIUrBly3B2 yQp47GsdgC4jarpLHWQk60oWlRw+QBvwCOEH877vmAjtMincwR3/s3Z7BbVD
EJJ8bvt4cicJPDHcXei3rUYiY543+wX5YNcoMCbKmcPPVXBGeqj1MxoxppoV pDUF7TkEHdw0ZBMBojgyC8us08w+xOcFbwQB86zXWeiullPxzIgiJyMcqTfk
WPr3vaYhcLLc2gFs28r4cRitDH9bVGGyEScGxlf1eq5pChmfC500DoG4ejhn NsdzL++Xz/pJEUBkgy4JwK6WWKHPffe7HhLu6rk2+SjcAr6whGHnmrWOYf04
PduZSm5Ga3QfTCzU5RVAyrm8QTTEMN/1VMKQTcuyDk+WkS0UmD9lmijy+bbX xwBE3NUMBNq1BWuFXK4XMzXtLKO46GRpxR/loUy4E4SghWV+/qW4YUYlO9pq
ABjHPxMG4nRd34UfdjGjk0bkje+jkhk2glVnZoOxADPEmdV8r0TSGP03JWWw TG2oW+Ss59TyaKDl6dw= =jvNG

26. Also used to prove identity…
• As both keys can encrypt and decrypt (but only from each other)it is
possible to prove an identity.
• Alice sues her private key to say encrypt a message.
• Everybody on the internet can decrypt this.
• But as Alice is the only person who has access to her private key to do
the encryption and the public key will only decrypt cipher text from it
matching private key , if the message decrypts then it is definitely
from Alice.

27. Also web sites!
• When you see the little padlock sign on a web address in your browser window:
• This means it has used “Hyper Text Transfer Protocol Secure”.
• The web site has a public key and data you send to them is encrypted.
• The validity of the website is established through a ‘certificate’.
• Certificates guarantee the website is genuinely who they say they are.
• They are granted by a DigitCert - an organisation who record lots of information about the company and only grant
them following a long procedure.
• When you visit a site the identity of the site is verified by using the same procedure as individual identity – there is
a part of the certificate that could only have been created by somebody with the private key.
• Once identity has been established a symmetric key is passed between the two computers and much faster
communication can take place.

28. Is this warfare?
• One key issue of encryption technologies is that they make it impossible for
the state to intervene and decrypt messages.
• Indeed selling encryption software is regarded in the same way as arms
trading - subject to export restrictions.
• The West does not want its enemies having this technology.
• Similarly law enforcement often has battles with technology companies to
decrypt messages and technologies and even install ‘back doors’ on devices
so the government can attack them.
• However opposition groups argue that the government and law
enforcement are very leaky and if the ability to decrypt messages is held by
them at some point it will get into the hands of bad guys, hackers and
criminals, it would lose its power…

29. Should technology manufacturers be forced
to assist the government?
• Discussion task:
• Group 1 - Construct a scenario where which would make a good case
for the government justifying forcing technology companies to install
back doors.
• Group 2 – construct a counter scenario to safe guard individual rights.
Present your cases!