> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-9-cryptography-and-password-security-analysis.md).

# Topic 9: Cryptography and Password Security Analysis

### Simple Explanation

Cryptography is the science of hiding/protecting information so only the intended person can read it  like writing a secret message in a code only you and your friend understand. In cyber security, it's the backbone of confidentiality, integrity, and authentication.

***

### 1. What is Cryptography?

The practice of securing information by transforming it (**encryption**) so it becomes unreadable to anyone without the correct key, and reversing that transformation (**decryption**) for authorized parties.

#### Basic Terminology

| Term          | Meaning                                                         |
| ------------- | --------------------------------------------------------------- |
| Plaintext     | The original, readable data                                     |
| Ciphertext    | The encrypted, unreadable data                                  |
| Key           | A secret value used to encrypt/decrypt                          |
| Cipher        | The algorithm used to encrypt/decrypt                           |
| Cryptanalysis | The science of breaking/analyzing cryptographic systems         |
| Cryptology    | The umbrella field covering both cryptography and cryptanalysis |

### 2. Encryption vs Hashing vs Encoding (commonly confused — important distinction)

| Concept        | Reversible?              | Purpose                                                                             |
| -------------- | ------------------------ | ----------------------------------------------------------------------------------- |
| **Encryption** | Yes (with the right key) | Confidentiality — hide data, can be brought back to original form                   |
| **Hashing**    | No (one-way)             | Integrity/verification — produces a fixed-size "fingerprint" of data                |
| **Encoding**   | Yes (no key needed)      | Data format conversion (e.g., Base64) — NOT for security, just format compatibility |

### 3. Types of Encryption

#### A. Symmetric Encryption

* Same key is used for both encryption and decryption.
* **Fast**, good for encrypting large amounts of data.
* **Challenge:** securely sharing/distributing the key between parties (key distribution problem).

| Algorithm                              | Notes                                                                           |
| -------------------------------------- | ------------------------------------------------------------------------------- |
| **DES (Data Encryption Standard)**     | Old, 56-bit key — considered broken/insecure today                              |
| **3DES (Triple DES)**                  | Applies DES three times — more secure but slow, largely deprecated              |
| **AES (Advanced Encryption Standard)** | Current industry standard, key sizes 128/192/256-bit, very secure and efficient |
| **RC4**                                | Stream cipher, used in older WEP/early SSL — now considered insecure            |
| **Blowfish/Twofish**                   | Alternative symmetric algorithms, still used in some contexts                   |

#### B. Asymmetric Encryption (Public Key Cryptography)

* Uses a **key pair**: a **public key** (shared openly) and a **private key** (kept secret).
* Data encrypted with the public key can only be decrypted with the matching private key (and vice versa for digital signatures).
* **Slower** than symmetric, so usually used for exchanging keys or small amounts of data (like the initial handshake), not bulk data.

| Algorithm                             | Notes                                                                                                          |
| ------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| **RSA**                               | Most widely used, based on the difficulty of factoring large prime numbers                                     |
| **Diffie-Hellman (DH)**               | Used specifically for secure *key exchange*, not general encryption                                            |
| **ECC (Elliptic Curve Cryptography)** | Provides similar security to RSA with much smaller key sizes — efficient, used in modern systems (mobile, TLS) |

#### C. Hybrid Encryption (how real-world systems actually work, e.g., HTTPS/TLS)

1. Asymmetric encryption is used briefly to securely exchange a **session key**.
2. That session key is then used with fast **symmetric encryption** for the actual data transfer. This gets the security of asymmetric key exchange with the speed of symmetric encryption.

### 4. Hashing

Converts input data of any size into a **fixed-length** output ("digest" or "hash value"). One-way — you cannot reverse a hash back to the original input.

#### Properties of a Good Hash Function

* **Deterministic** — same input always gives same output.
* **Fast to compute.**
* **Pre-image resistant** — can't reverse the hash to find the original input.
* **Collision resistant** — extremely hard to find two different inputs that produce the same hash.
* **Avalanche effect** — a tiny change in input drastically changes the output hash.

| Algorithm                    | Notes                                                                                                                                |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| **MD5**                      | 128-bit output; broken — collisions can be found easily; should NOT be used for security purposes today                              |
| **SHA-1**                    | 160-bit output; also broken (collision demonstrated by Google in 2017 — "SHAttered attack"); deprecated                              |
| **SHA-256 / SHA-3**          | Current secure standards, used widely (part of the SHA-2 and SHA-3 families)                                                         |
| **bcrypt / scrypt / Argon2** | Specifically designed for **password hashing** — intentionally slow and memory-intensive to resist brute-force/rainbow table attacks |

#### Uses of Hashing

* Password storage (never store plaintext passwords)
* Verifying file/download integrity (checksum comparison)
* Digital signatures (hash the message, then encrypt the hash with a private key)
* Blockchain (chaining blocks together via hashes)

### 5. Salting (critical password security concept)

A **salt** is a random, unique value added to a password *before* hashing it.

* Prevents two users with the same password from having identical hashes.
* Defeats **rainbow table attacks** (precomputed hash lookup tables become useless because the attacker would need a new table for every possible salt).
* The salt itself doesn't need to be secret — it's usually stored alongside the hash — its purpose is uniqueness, not secrecy.
* Modern password hashing functions (bcrypt, Argon2) build in salting automatically.

**Pepper** — an additional secret value (unlike a salt, kept secret and often stored separately, e.g., in application code/config rather than the database) added for extra protection.

### 6. Digital Signatures

Used to verify the **authenticity** and **integrity** of a message, and to provide **non-repudiation** (the sender can't deny sending it).

#### Process:

1. Sender hashes the message.
2. Sender encrypts that hash with their **private key** → this is the digital signature.
3. Receiver decrypts the signature using the sender's **public key** to recover the hash.
4. Receiver independently hashes the received message and compares it to the decrypted hash.
5. If they match → message is authentic and unaltered.

### 7. PKI — Public Key Infrastructure

The framework of policies, roles, and systems needed to manage public-key encryption at scale.

| Component                             | Role                                                                            |
| ------------------------------------- | ------------------------------------------------------------------------------- |
| **Certificate Authority (CA)**        | Trusted entity that issues and verifies digital certificates                    |
| **Digital Certificate**               | Binds a public key to an identity (person/organization/website), signed by a CA |
| **Registration Authority (RA)**       | Verifies identity before a certificate is issued                                |
| **Certificate Revocation List (CRL)** | List of certificates that are no longer valid/trusted                           |

This is exactly how **HTTPS/SSL/TLS** works — websites present a certificate signed by a trusted CA to prove their identity to your browser.

### 8. Steganography

Hiding the *existence* of a message (not just its content) — e.g., hiding text data inside an image or audio file, so an observer doesn't even know secret data is present. Different from cryptography, which hides the *content* but not the fact that a message exists.

### 9. Cryptographic Attacks

| Attack                      | Description                                                                                        |
| --------------------------- | -------------------------------------------------------------------------------------------------- |
| **Brute Force**             | Trying every possible key                                                                          |
| **Known Plaintext Attack**  | Attacker has both plaintext and its corresponding ciphertext, tries to derive the key              |
| **Chosen Plaintext Attack** | Attacker can choose plaintexts and see their ciphertexts                                           |
| **Man-in-the-Middle**       | Intercepting/altering communication during key exchange                                            |
| **Birthday Attack**         | Exploits probability math to find hash collisions faster than brute force                          |
| **Rainbow Table Attack**    | Precomputed hash-to-plaintext lookup (defeated by salting)                                         |
| **Side-Channel Attack**     | Exploiting physical implementation details (timing, power consumption) rather than the math itself |

### 10. Password Security Best Practices (analysis/comparison for exam)

| Practice                            | Why it matters                                                         |
| ----------------------------------- | ---------------------------------------------------------------------- |
| Minimum length 12+ characters       | Exponentially increases brute-force time                               |
| Use passphrases                     | Easier to remember, hard to crack                                      |
| No password reuse                   | Prevents credential stuffing across services                           |
| Use a password manager              | Enables unique strong passwords everywhere                             |
| Enable MFA                          | Adds a second layer beyond just the password                           |
| Hash + Salt storage (bcrypt/Argon2) | Protects passwords even if the database is breached                    |
| Account lockout / rate limiting     | Slows brute-force and spraying attacks                                 |
| Avoid common/leaked passwords       | Check against breach databases (e.g., "Have I Been Pwned" style lists) |

***

### Exam Points (Quick Revision)

* Encryption (reversible, needs key) vs Hashing (one-way) vs Encoding (reversible, no key, not security).
* Symmetric = same key (AES, DES, 3DES) — fast, key-distribution problem.
* Asymmetric = public/private key pair (RSA, DH, ECC) — slower, solves key distribution.
* HTTPS uses hybrid encryption: asymmetric for key exchange, symmetric for bulk data.
* MD5 and SHA-1 = broken/deprecated; SHA-256/SHA-3 = current standard for general hashing; bcrypt/Argon2 = for passwords specifically.
* Salting defeats rainbow tables; salt doesn't need to be secret, pepper does.
* Digital Signature = hash + encrypt with sender's private key → verified with sender's public key.
* PKI components: CA, Digital Certificate, RA, CRL.
* Steganography hides the *existence* of data; cryptography hides the *content*.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-9-cryptography-and-password-security-analysis.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.