Sequentia Explores: The Mathematics of Crypto
Part I: The Foundations of Digital Trust
Lecture 5: A Bird’s-Eye View: The Three Pillars of Information Security
Over the past four lectures, we’ve set the stage for our exploration of cryptography. We’ve distinguished it from cryptocurrency, understood the inherent untrustworthiness of digital information, embraced the power of public systems with secret keys (Kerckhoffs’s Principle), and met our cast of characters: Alice, Bob, Eve, and Mallory.
Now, before we dive into our first cipher, let’s establish a simple framework that will guide us for the rest of this series. When Alice sends a message to Bob, what is she actually trying to achieve? What does it mean for their communication to be “secure”?
Nearly every goal in information security can be distilled down to three fundamental pillars. These are the core objectives that cryptographic tools are designed to provide. Let’s call them the Three Pillars of Information Security: Confidentiality, Integrity, and Authenticity.
Pillar 1: Confidentiality (Keeping Secrets Secret)
- The Question: Can anyone other than the intended recipient read the message?
- The Goal: Ensure that information is accessible only to authorized individuals.
- Our Characters: This is all about defeating Eve, the Eavesdropper.
Confidentiality is the most intuitive goal of cryptography. It’s the “secret” in “secret message.” When Alice sends an encrypted message to Bob, she wants to be certain that if Eve intercepts it, all Eve sees is unintelligible ciphertext.
The primary tool for achieving confidentiality is encryption. By using a cipher and a secret key, Alice transforms her plaintext into ciphertext. Only someone with the correct key (Bob) can decrypt it. The strength of the encryption algorithm determines how well the message is protected from Eve’s prying eyes.
Analogy: Confidentiality is the sealed, opaque envelope. You can’t see what’s inside without breaking it open, and only the intended recipient has the “key” (the letter opener and the context) to understand its contents.
Pillar 2: Integrity (Ensuring the Message is Unaltered)
- The Question: Is the message I received the exact same message that was sent?
- The Goal: Safeguard the accuracy and completeness of information.
- Our Characters: This is about defeating Mallory, the Malicious Attacker.
While confidentiality is crucial, it’s not enough. What if Mallory intercepts Alice’s encrypted message to Bob? She might not be able to read it, but what if she could alter it? What if she could flip a few bits in the ciphertext, and when Bob decrypts it, the message has changed from “Attack at dawn” to “Retreat at dawn”?
Integrity ensures that the data has not been modified, tampered with, or corrupted in transit, whether maliciously or accidentally. Cryptographic tools must provide a way for Bob to verify that the message he is decrypting is the pristine, original message that Alice sent.
The primary tools for this are cryptographic hash functions and message authentication codes (MACs). These create a unique, fixed-size “fingerprint” of a message. If even one character of the message is changed, the fingerprint will be completely different. We will explore these fascinating tools in depth later in the series.
Analogy: Integrity is like a tamper-evident seal on a medicine bottle. You don’t just trust that the contents are correct; you can see physical proof that no one has opened or altered them since they were sealed at the factory.
Pillar 3: Authenticity (Verifying the Source)
- The Question: Do I know for sure who sent this message?
- The Goal: Confirm that the origin of the information is genuine.
- Our Characters: This is also about defeating Mallory, specifically when she tries to impersonate someone else.
Authenticity is about proving identity. When Bob receives a message that says it’s from Alice, how can he be mathematically certain it truly originated from her and not from Mallory pretending to be Alice?
This is a step beyond integrity. Integrity confirms the message wasn’t changed. Authenticity confirms who sent the original message.
The primary tool for achieving authenticity is the digital signature. A digital signature is a cryptographic mechanism that binds a person’s identity to a specific piece of digital information. It’s far more powerful than a handwritten signature because it is computationally impossible to forge, and it is unique to both the sender and the message itself.
Analogy: Authenticity is like a notarized signature on a legal document. An independent, trusted party (the notary, or in our case, the mathematics of the system) has verified the identity of the signer, providing a high level of assurance that the signature is not a forgery.
A Framework for Our Journey
As we move forward and analyze different ciphers and protocols, we will constantly refer back to these three pillars. For each system, we’ll ask:
- Does it provide Confidentiality? (Can Eve read it?)
- Does it provide Integrity? (Can Mallory alter it undetected?)
- Does it provide Authenticity? (Can Mallory impersonate Alice?)
You will discover that early, simple ciphers (like the Caesar Cipher we’ll see next) might only provide weak confidentiality and offer no integrity or authenticity at all. Modern cryptographic systems, on the other hand, are complex marvels of engineering designed to provide all three pillars with mathematical certainty.
This framework—Confidentiality, Integrity, Authenticity—is our map. Now, with our map in hand, we are finally ready to take our first step into the territory of ciphers.
