Cryptography

Let me take you to a battlefield — but a silent one. During World War II, Germany encrypted its military communications with a machine called Enigma, believed to be unbreakable. At Bletchley Park in England, a team of mathematicians led by Alan Turing broke it — and historians estimate this shortened the war by years and saved millions of lives. No bullet was fired in this battle; it was won by mathematics.

That is cryptography: the science of secret writing (from the Greek kryptos = hidden, graphein = to write). And today, you use it a hundred times a day without knowing — every UPI payment, every WhatsApp message, every ‘https’ website is a small Enigma battle being fought and won for you.

What is Cryptography? Its Objectives

• Cryptography is the technique of securing information by converting it into an unreadable form (ciphertext) using algorithms and keys, so that only authorised parties can access and understand it.
• It is the backbone of cybersecurity, digital communication, and data privacy.

Cryptography pursues four objectives. Remember them as C-I-A-N — Confidentiality, Integrity, Authentication, Non-repudiation:

Objective	What It Ensures	Simple Illustration
Confidentiality	Information is accessible only to authorised users; prevents unauthorised access or leakage	A sealed envelope only the addressee can open
Integrity	Data remains unchanged during transmission; detects tampering or modification	A tamper-evident seal on a parcel
Authentication	Verifies the identity of sender/receiver; the communicating parties are genuine	Checking an ID card before entry
Non-repudiation	The sender cannot later deny sending the message; proof of origin and delivery	A signed registered-post receipt

Components of Cryptography — The Building Blocks

Every cryptographic system, however sophisticated, is built from six simple blocks. Watch the journey of a message:

THE JOURNEY OF A SECRET MESSAGE

▼

PLAINTEXT — the original, readable message e.g., HELLO

▼

ENCRYPTION — algorithm (cipher) + key transform it Key decides how the transformation happens

▼

CIPHERTEXT — unreadable form; looks like random data e.g., XJ92#P — meaningless to any interceptor

▼

DECRYPTION — correct key restores the original Only the authorised holder of the key can do this

▼

PLAINTEXT recovered by the intended recipient

• Plaintext: The original readable data (text, numbers, images, any digital data) — the input to encryption.
• Ciphertext: The encrypted, unreadable output — appears random to unauthorised users.
• Encryption: The process of converting plaintext into ciphertext — ensures confidentiality in storage and transmission.
• Decryption: Converting ciphertext back into plaintext using the appropriate key.
• Key: A secret value used to encrypt/decrypt. Here is the profound principle of modern cryptography: the security of the system depends on the secrecy of the key, not the secrecy of the algorithm — algorithms like AES are published openly for the world to attack and test.
• Algorithm (cipher): The mathematical procedure for encryption/decryption — e.g., AES (Advanced Encryption Standard), RSA (Rivest–Shamir–Adleman), DES (Data Encryption Standard, now obsolete). The same algorithm produces different ciphertexts with different keys.

Types of Cryptography

Now the heart of the chapter. There are three families, and the easiest way to remember them is by counting keys: one key (symmetric), two keys (asymmetric), no key (hash).

Symmetric Key (Secret Key) Cryptography — One Key

Think of a household locker: the same key locks and unlocks it. Sender and receiver share one secret key. E.g., DES and AES.

WORKING OF SYMMETRIC KEY CRYPTOGRAPHY

▼

Sender encrypts plaintext with the SECRET KEY → ciphertext

▼

Ciphertext travels over the communication channel

▼

Receiver decrypts with the SAME SECRET KEY → plaintext

• Applications: Secure data storage; VPNs (Virtual Private Networks); encrypting large volumes in databases and cloud storage; financial transactions (online banking, payments).
• Advantages: High speed and computational efficiency; suited to bulk data encryption in real time; simple design.
• Limitations: The key distribution problem — how do you securely share the secret key in the first place? (Sit with this question for a moment — if you had a secure channel to send the key, why not send the message itself through it? This paradox is exactly what asymmetric cryptography solves.) Also: weak key management is risky on open networks; if the key is compromised, the whole system collapses.

Asymmetric Key (Public Key) Cryptography — Two Keys

Now the elegant solution, one of the most beautiful ideas of the 20th century. Each person has a pair of mathematically related keys: a public key, shared openly with the world, and a private key, never shared with anyone.

Think of a letterbox: anyone can drop a letter in through the slot (public key = encryption), but only the owner has the key to open it (private key = decryption). The need to share a secret vanishes. E.g., RSA and ECC (Elliptic Curve Cryptography).

WORKING OF ASYMMETRIC KEY CRYPTOGRAPHY

▼

Sender encrypts plaintext with the RECEIVER’S PUBLIC KEY

▼

Ciphertext travels over the network — safe even if intercepted

▼

Receiver decrypts with their own PRIVATE KEY (known to no one else)

• Applications: Secure key exchange over open networks; digital signatures (authenticity + non-repudiation); HTTPS secure browsing; email encryption and authentication.
• Advantages: Solves the key distribution problem; enables secure communication over the open Internet; supports digital signatures and authentication.
• Limitations: Slower than symmetric cryptography; computationally intensive; not ideal for directly encrypting large volumes of data. (Hence the practical marriage you will see in SSL/TLS: asymmetric for the handshake, symmetric for the conversation.)

Hash Functions (One-Way Cryptography) — No Key

The third family is different in spirit: it does not hide data, it fingerprints it. A hash function converts any input into a fixed-length output (hash value/digest) through a one-way mathematical function — you can never get the input back from the output.

Just as a fingerprint identifies a person but cannot recreate the person. E.g., SHA-256 (Secure Hash Algorithm) and MD5 (Message Digest 5 — now considered broken; noted here for the exam).

• Key features: Fixed-length output regardless of input size; one-way (irreversible); the avalanche effect — change one letter of the input and the entire hash changes unrecognisably; no key required in basic hashing.
• Working: Input → hash algorithm → unique digest; the same input always produces the same hash.
• Applications: Password storage (systems store the hash, not your password); data-integrity verification; digital signatures; blockchain — blocks are chained by cryptographic hashes.
• Advantages: Very fast; guarantees integrity by exposing any tampering; irreversibility enhances security.
• Limitations: Hash collisions possible (two inputs producing the same hash); unusable for encryption–decryption since the original data cannot be recovered.

Comparison — The Table to Memorise

Feature	Symmetric Key	Asymmetric Key	Hash Functions (One-Way)
Keys used	Single shared key	Two keys (public + private)	No key (generally)
Nature	Reversible	Reversible	Irreversible
Speed	Fast	Slow	Very fast
Security level	Moderate	High	Very high (for integrity)
Key distribution	Difficult	Easy (public key shared)	Not required
Main purpose	Data encryption	Secure key exchange, authentication	Data integrity verification
Examples	AES, DES	RSA, ECC	SHA-256, MD5
Use cases	Bulk data encryption	Digital signatures, secure communication	Password storage, blockchain

Important Cryptographic Techniques

Digital Signature

Here is a question to sharpen your thinking: encryption hides a message — but how do you prove who wrote it? Answer: reverse the key usage!

In encryption, the sender uses the receiver’s public key. In a digital signature, the sender uses their own private key — and since only they possess it, only they could have signed.

It is an electronic method of verifying the authenticity, integrity, and origin of a digital message, and it is recognised under law (in India, under the Information Technology Act, 2000), making digitally signed documents legally admissible and enforceable.

How it works — notice how it elegantly combines both hash functions and asymmetric cryptography:

1. The message is passed through a hash function, producing a fixed-length message digest.
2. The digest is encrypted with the sender’s PRIVATE key — this creates the digital signature.
3. The signature is attached to the message and sent.
4. The receiver decrypts the signature with the sender’s PUBLIC key to recover the original digest.
5. The receiver independently computes a fresh hash of the received message.
6. The two digests are compared.
7. If they match → the message is authentic (only the sender’s private key could have signed), unaltered (integrity), and undeniable (non-repudiation)
   • Components used: Hash function (integrity) + asymmetric cryptography (authentication).
   • Applications: E-governance (Aadhaar, e-Sign), online banking, income-tax return filing, digital contracts and emails.

Public Key Infrastructure (PKI)

One problem remains. When a website shows you a public key claiming ‘I am your bank’, who vouches for that claim? Enter PKI — the framework of policies, technologies, and procedures for creating, managing, distributing, and verifying digital certificates and public keys. It is the digital world’s passport system.

Component of PKI	Function
Certificate Authority (CA)	Issues and verifies digital certificates — the trusted third party that authenticates identities
Registration Authority (RA)	Verifies user identity before certificate issuance — background checks and validation
Digital Certificates	Electronic documents binding a user’s identity to their public key
Public & Private Keys	Encryption, decryption, authentication — public key shared openly, private key kept secret

HOW PKI WORKS

▼

1. Key pair generation — user creates a public + private key

▼

2. Certificate Signing Request (CSR) sent to the CA with public key & identity details

▼

3. CA verifies the user’s identity

▼

4. CA issues a Digital Certificate (identity + public key + CA’s digital signature)

▼

5. Secure communication — sender encrypts using the receiver’s certified public key

▼

6. Receiver decrypts with their private key

▼

7. Certificate validated using the CA’s public key — trust established

• Applications: Secure websites (HTTPS), digital signatures, e-commerce transactions, e-governance services.

SSL/TLS (Secure Sockets Layer / Transport Layer Security)

Look at your browser’s address bar — that padlock next to ‘https’ is SSL/TLS at work: cryptographic protocols for secure communication over networks, especially the Internet. And here is the exam-worthy insight: TLS is a masterpiece of teamwork between all three cryptography families you just learnt.

THE SSL/TLS HANDSHAKE

▼

Client (browser) requests a secure connection

▼

Server responds with its digital certificate (containing its public key)

▼

Client verifies the certificate via trusted Certificate Authorities (CAs)

▼

A session key is generated & shared securely using ASYMMETRIC cryptography

▼

Thereafter, the conversation runs on fast SYMMETRIC encryption; HASH functions guard integrity

• Division of labour: Asymmetric cryptography — secure key exchange during the handshake; symmetric cryptography — fast bulk encryption of the session; hash functions — data integrity.
• Applications: Secure websites (HTTPS), online banking and payments, email security, e-commerce platforms.

End-to-End Encryption (E2EE)

When WhatsApp tells you ‘messages are end-to-end encrypted’, it means this: the message is encrypted on the sender’s device and decrypted only on the receiver’s device. In between — across towers, cables, and servers — it travels as gibberish. Not even the service provider can read it.

• How it works: Sender encrypts with the recipient’s public key → encrypted message passes through servers unreadable → only the recipient’s private key (stored only on their device) can decrypt it.
• Components: Asymmetric cryptography (key exchange) + symmetric cryptography (fast message encryption) + keys stored only on user devices.
• Applications: Messaging apps (WhatsApp, Telegram, etc.), secure email, voice and video calls.
• The policy debate (think for Mains): E2EE protects privacy — but it equally blinds lawful interception. The tension between individual privacy and national security is a live regulatory debate in India and worldwide.

Digital Certificates

• What: An electronic document that verifies the identity of an individual, organisation, or website and links it to a public key — a digital identity proof issued by a trusted Certificate Authority (CA).
• Contents: Owner’s name; public key; issuing CA’s details; validity period; the CA’s digital signature.
• Working: Obtain certificate from CA → share it during communication → receiver verifies the CA’s signature → once verified, the certified public key is trusted for encryption and secure communication.

Applications of Cryptography — Where You Meet It Daily

• Secure communication: Confidentiality and integrity of transmitted data — protection from interception and tampering.
• Digital payments & banking: UPI, net banking, card payments — encryption, authentication, fraud prevention.
• E-Governance: Aadhaar, e-Sign, online tax filing — secure identity verification and service delivery.
• Authentication & access control: Password hashing, digital certificates, multi-factor authentication.
• Data protection & privacy: Securing databases, cloud infrastructure, devices.
• Digital signatures & legal transactions: Authenticity, integrity, non-repudiation for contracts and filings.
• Blockchain & cryptocurrencies: Hashing + key mechanisms → transparency, immutability, trust in decentralised systems.
• Defence & national security: Protecting military communications, intelligence data, strategic systems.
• Internet of Things (IoT): Securing device-to-device communication against breaches and remote exploitation.
• Email & messaging security: Encryption protocols guarding everyday communication.

Concerns with Cryptography

• Quantum computing threat: Sufficiently powerful quantum computers could break existing encryption — especially public-key (asymmetric) cryptography (see box below).
• Key management issues: Secure generation, storage, distribution, and recovery of keys remains complex and error-prone.
• Cyber attacks & misuse: Weak implementations invite phishing, ransomware, brute-force attacks.
• Regulatory & legal challenges: Strong encryption can hinder lawful interception — the law-enforcement vs privacy dilemma.
• Dependence on algorithms: Outdated or weak algorithms (e.g., DES, MD5) create vulnerabilities.
• Insider threats: Trusted individuals misusing keys or access can defeat any mathematics.
• Performance overhead: Encryption/decryption adds computational load in large-scale systems.
• Interoperability issues: Differing standards and protocols across systems complicate implementation.

Current Affairs Lens: The Quantum Threat & Post-Quantum Cryptography (PQC) Why does quantum computing frighten cryptographers? Because asymmetric cryptography (RSA, ECC) rests on mathematical problems — like factoring huge numbers — that classical computers cannot solve in reasonable time but quantum algorithms (e.g., Shor’s algorithm) could. The danger is compounded by ‘harvest now, decrypt later’ — adversaries storing today’s encrypted data to crack tomorrow. The global response: In August 2024, the US NIST released the first three finalised post-quantum cryptography standards — FIPS 203 (ML-KEM, based on CRYSTALS-Kyber, for general encryption/key encapsulation), FIPS 204 (ML-DSA, based on CRYSTALS-Dilithium, for digital signatures), and FIPS 205 (SLH-DSA, a stateless hash-based signature scheme). India’s response: The National Quantum Mission (2023) promotes indigenous quantum technologies, and Indian agencies have begun preparing roadmaps for migration to quantum-safe cryptography. For the exam, remember the pairing: quantum computers threaten public-key cryptography; hash functions and symmetric systems (with larger keys) are comparatively resilient.