Cryptography

1. Choose two large prime numbers \(p\) and \(q\). This is secret.
2. Compute \(n=pq\). This is part of the public key.
3. Compute Carmichael's totient function of \(n\), \(\lambda(n)\). This is secret. It can be easily computed if we know the prime factor of \(n\), but practically impossible if we don't.
   • The original paper uses Euler's totient function instead.
4. Choose an integer \(e\), such that \(2< e < \lambda(n)\) and it is coprime to \(\lambda(n)\). This is part of the public key.
5. Determine \(d\) satisfying \(d\equiv e^{-1}\pmod{\lambda(n)}\). This is part of the private key.
   • \(d\) can be computed by extended Euclidean algorithm.

It uses the fact that: \[ m \equiv m^{ed}\pmod{n}. \]

Encrypt \(m\) with \(c = m^{a}\pmod{n}\), where \(a\) is either \(e\) or \(d\). Use \(e\) for and \(d\) for digital signiture.

Decrypt \(c\) with \(m = c^b\pmod{n}\), where \(b\) is either \(d\) or \(e\).

1. Five 4 bytes internal states \( H_0, H_1,\dots,H_4 \) are set to the value that is determined by the specification.
2. Take 512 bits of the message (pad it if necessary) and use compression function 80 times on it with the internal states.
3. Add the result to the initial internal states, under modulo 160 bit.
4. Set the internal states to be the result of the addition.
5. Repeat the procedure until the message gets exhausted.

• Distinguished Encoding Rules

Binary Encoding of data defined along with Basic Encoding Rules (BER) and Canonical Encoding Rules (CER)(??, 2021).

• Privacy-Enhanced Message or Privacy-Enhanced Mail, Privacy-enhanced Electronic Mail

Encoding of binary data into ASCII. Base64 encoding with begin/end markers. -

-----BEGIN PRIVATE KEY-----
MIICdg....
... bhTQ==
-----END PRIVATE KEY-----

• Digital Certificate, Identity Certificate

A certificate contains metadata and public key encoded in DER format, with the digital signature of certificate authority attached at the end.

The validity of certificate autority are established through the chain of trust consisting of certificates signed by higher authority, eventually leading up to the root CAs whose certificates are distributed by the operating system, and system administrator on each local machine.

Root certificates are any truested self-signed certificates.

• SSL inspection

The corporate root CA can be installed to the local machines within the local network, allowing the gateway to issue certificates for the external websites and act as the man in the middle.

CA의 인증을 받은 public private key pair를 local machine이나 cloud에 보관

NPKI

• National public key infrastructure
• Person, Legal Person, Server
• (구)공인인증서 -> 공동인증서
• 공인인증기관의 Root CA
• 6개 인증기관에서 은행, 증권회사 등의 대행을 통해 인증서를 발급받는다.
  • 한국정보인증(KICA)
  • 코스콤(KOSCOM)
  • 금융결제원(KFTC)
    • 은행이 대행한다.
  • 한국전자인증(KECA)
  • 한국무역정보통신(KTNET)
  • 한국정보사회진흥원

GPKI

• Government Public Key Infrastructure
• PKI for governmental entities.
• 행정인증서

MPKI

• 국방인증서

금융인증서

• 금융기관의 Root CA
• 금융결제원의 인증을 거친다.

사설인증서

• 민간업체의 Root CA

The format may contain certificates, public and private keys in a single file.

• gpg
• GNU Privacy Guard

GnuPG is part of GNU project that implements OpenPGP standard.

Chain of encryption for information exchange:

It also supports symmetric encryption in which the key is generated from the passphrase using S2K (string-to-key) algorithm.

• Cryptographic primitives such as SHA256 digest or AES encryption.

• Group of algorithms that have the same purpose such as encrypting or digesting.

• A provider contains cryptographic algorithms so that it can be loaded modularly.

$ openssl <command> [ <option> ... ] [ <parameter> ]