pk.org: Computer Security/Lecture Notes

Week 2 Study Guide

Symmetric Cryptography

Paul Krzyzanowski – 2026-09-14

Focus on what each cipher did, why it was broken, and what the break taught. The dates, names of people, and mechanical details in the lecture notes provide context, but are not things you are expected to remember.

Goals and Terms

Cryptography serves four goals:

  1. Confidentiality keeps a message hidden from anyone not authorized to read it.

  2. Authentication verifies the origin of a message or the identity of a party.

  3. Integrity ensures that a message has not been modified.

  4. Non-repudiation prevents a sender from denying that they sent a message.

In this section, we’re concerned about confidentiality.

The basic vocabulary applies to every cipher:

The keyspace is the set of all possible keys, and a brute-force attack tries every key in it. A large keyspace is necessary for security, but never enough, because even ciphers with an enormous keyspace were broken without searching it.

Kerckhoffs’s Principle

Kerckhoffs’s Principle states that a cryptosystem must remain secure when the adversary knows everything about it except the key. Algorithms become known through reverse engineering, defection, and capture; a system that depends on the secrecy of its method is permanently broken once the method is known, whereas a key can be replaced. Open designs also allow weaknesses to be found and fixed before an adversary finds them.

Schneier’s Law is the observation that anyone can design a cipher that they themselves cannot break. Confidence in a cipher’s strength is established only by the failure of other people, who want to break it, to do so over a long period of time.

Classical Ciphers

Classical ciphers are the hand ciphers used before the twentieth century. Nearly all of them are one of two kinds:

Substitution and Frequency Analysis

The Caesar cipher shifts every letter by a fixed amount, and the shift is the key. A monoalphabetic substitution cipher generalizes this to any fixed mapping from plaintext letters to ciphertext letters, giving \(26!\) possible keys.

Frequency analysis breaks any monoalphabetic cipher. Letters and pairs of letters (bigrams) occur with characteristic frequencies in every language, and a fixed substitution relabels the symbols without changing those frequencies. The most common ciphertext symbol almost certainly stands for the most common plaintext letter, and the rest follows. The size of the keyspace is irrelevant because the attacker never searches it.

This attack established the goal that every later cipher pursues: ciphertext should appear statistically random, with no patterns for an analyst to measure.

Polyalphabetic Substitution

A polyalphabetic cipher changes the substitution alphabet as it moves through the message, so the same plaintext letter encrypts differently in different positions. Single-letter frequency counts then reveal nothing.

The Alberti cipher was the first to propose this, using a set of concentric disks, each with an alphabet along its circumference. Rotating one of the disks changed the substitution alphabet.

The Vigenère cipher uses a keyword repeated to the length of the message. The repeated keyword is the keystream, the sequence of key values applied one by one to the plaintext, and each keystream letter selects a Caesar shift for the plaintext letter beneath it. The number of letters before the keystream repeats is its period. The cipher was considered unbreakable for three centuries.

The Kasiski attack breaks it by exploiting the period. Repeated plaintext that happens to align with the same part of the keystream produces repeated ciphertext, and the distances between repeats are multiples of the period. Once the period is known, the ciphertext splits into that many interleaved Caesar ciphers, and frequency analysis solves each one. The lesson is that a key shorter than the message must repeat, and the repetition leaves a trace. A key as long as the message with no repetition would have no period, and that idea becomes the one-time pad.

Transposition

A transposition cipher, such as columnar transposition, writes the message into a grid and reads it out in an order determined by a keyword. Because the letters are unchanged, frequency analysis immediately reveals the language, and an analyst can recover the grid by trying widths and looking for columns that produce common bigrams when placed side by side.

Padding is filler added so that a message fits a required size. It appears in classical grids and in modern block ciphers, and badly designed padding can leak information.

Bigram Substitution and Combined Ciphers

Substitution hides the letters but preserves their statistics. Transposition preserves the letters but hides their positions. Two ideas resisted frequency analysis. The Playfair cipher substituted pairs of letters instead of single letters, which raised the cost of frequency analysis (the analyst must count pairs) without removing it. Ciphers that apply substitution and then transposition, such as the World War I ADFGVX cipher, are stronger than either alone because each step destroys what the other preserves. Every modern block cipher substitutes large units and alternates the same two operations over many rounds.

The classical era established a short list of conclusions:

Rotor Machines and Enigma

A rotor is a disk wired to perform a fixed substitution. A rotor machine stacks several rotors and turns them like an odometer after each letter, so the composite substitution changes with every keystroke. Its keystream, the sequence of rotor positions, has a period longer than any message, which removes the repetition that the Kasiski attack relies on onds.

Enigma was the German rotor machine of World War II. Its keyspace was about \(10^{23}\), and it was never broken by brute force. It was broken because of three things:

  1. Structural flaws. The reflector guaranteed that no letter ever encrypted to itself, and the plugboard applied a fixed substitution that could be separated from the rotors. Together, these removed most of the effective keyspace before any search began.

  2. Predictable plaintext. A crib is a stretch of plaintext that an analyst can guess, such as a weather report that always began the same way. The bombe, the machine that searched for daily settings, was useless without cribs.

  3. Operator behavior. Repeated message keys, reused settings, and lazy choices gave analysts shortcuts the machine itself did not offer.

Even unreadable traffic revealed information. Traffic analysis studies who is transmitting, to whom, when, and how much, without reading the messages. Encryption hides the contents of a message but not the fact that it was sent.

Polish mathematicians first broke Enigma in the 1930s by treating it as an algebraic problem, and Britain industrialized the attack. Enigma’s design was known to its enemies, so Kerckhoffs’s principle was satisfied. The machine was broken because its structure and its use had flaws that the size of the keyspace did not reveal.

Information Theory and Perfect Secrecy

Claude Shannon’s 1949 paper gave cryptography a mathematical foundation.

Entropy measures the uncertainty in a random variable, in bits. A fair coin has one bit of entropy; a heavily biased coin has much less. A source with maximum entropy cannot be compressed. English text carries only about one bit of information per letter, and the rest is redundancy: letters that a reader could have predicted. Redundancy is what frequency analysis feeds on.

A cipher has perfect secrecy if the ciphertext reveals no information about the plaintext: the adversary’s probability estimate for every possible plaintext is the same after seeing the ciphertext as before. No amount of computing power helps, because the information is not there. Perfect secrecy concerns only the contents of the message. It does not hide the message’s length or who sent it to whom.

The One-Time Pad

The exclusive-or (XOR) of two bits is 1 when they differ and 0 when they are the same. XORing with the same value twice restores the original, and XORing anything with a random bit produces a random bit.

The one-time pad encrypts by XORing the plaintext with a key of the same length and decrypts by XORing again with the same key. It has perfect secrecy provided that three conditions hold:

  1. The key is truly random and independent of the message.

  2. The key is at least as long as the message.

  3. The key is never reused.

Reusing a key is fatal because XORing two ciphertexts encrypted under the same key cancels the key and leaves the XOR of the two plaintexts, which the redundancy of language usually makes recoverable.

The one-time pad is impractical for most uses because it replaces the problem of sending a secret message with the problem of securely delivering a secret key of the same length. Shannon showed that this cost is unavoidable: perfect secrecy needs a key with at least as much entropy as the message.

Computational Security

Computational security means that breaking a cipher is infeasible for a bounded adversary, one with limited time, computing power, and money, even though it is possible in principle. The claim rests on two things:

  1. A key long enough that exhaustive search is infeasible (an \(n\)-bit key takes \(2^{n-1}\) trials on average, and each added bit doubles the work).

  2. A cipher with no structural shortcut that does better than exhaustive search.

The second can never be proved, which is why algorithms are published for analysis and systems are built so that an algorithm can be replaced. The standard is computational indistinguishability: an attacker who chooses two messages of the same length and is given an encryption of one should be unable to tell which was encrypted significantly better than by guessing.

Attack models describe what an adversary has to work with:

Modern ciphers must resist chosen-plaintext attacks at a minimum, and systems are expected to resist chosen-ciphertext attacks as well.

Confusion and Diffusion

Shannon named the two properties every practical cipher needs:

Good diffusion produces the avalanche effect: changing a single input bit flips about half of the output bits. Neither property is enough alone. A modern cipher alternates between a substitution step and a mixing step over many rounds, mixing in key material at each round. This is the structure of every modern block cipher.

Randomness

Every cipher depends on random values for keys and per-message inputs, and an adversary who can predict them does not need to attack the cipher. Three kinds of sequences are called random:

Application code should use the operating system’s CSPRNG rather than build its own. Predictable or reused random values have broken more real systems than any weakness in a cipher: the Netscape browser, Debian’s OpenSSL, the PlayStation 3, and hundreds of thousands of Internet certificates all failed because of the random number, not the algorithm.

Block Ciphers

A block cipher encrypts a fixed-size block of bits (64 or 128) into a block of the same size. For a given key, it is a one-to-one mapping of all possible blocks. Modern block ciphers build that mapping by repeating a round many times on an internal state, with a key schedule that expands the key into a separate round key for each round.

Two structures dominate the design of block ciphers:

DES and Triple DES

The Data Encryption Standard (DES), published in 1977, was the first public cipher standard. It has a 64-bit block, a 56-bit key, and 16 rounds. Its S-boxes turned out to resist differential cryptanalysis, an attack not published until 1990, because IBM had discovered the attack privately and designed against it.

DES failed because of its key length. A 56-bit key was brute-forced with purpose-built hardware in 1998. Its 64-bit block is a second limit: by the birthday bound, repeated blocks are expected after about \(2^{32}\) blocks, and in common modes a repeat leaks plaintext.

Triple DES (3DES) runs DES three times in an encrypt-decrypt-encrypt sequence. A meet-in-the-middle attack makes double encryption barely stronger than single, which is why three applications were needed. 3DES kept the small block, was slow, and is now disallowed.

AES

The Advanced Encryption Standard (AES) was selected in an open international competition and standardized in 2001. It is the cipher Rijndael with a 128-bit block and a 128-, 192-, or 256-bit key, using 10, 12, or 14 rounds. Each round applies four steps: SubBytes (S-box substitution, confusion), ShiftRows and MixColumns (diffusion), and AddRoundKey.

No practical attack on AES is known. It is fast in software and has hardware support (AES-NI) on most processors, which also makes it immune to cache-timing attacks. AES is the default choice for a block cipher.

Modes of Operation

A mode of operation defines how a block cipher is applied to a message longer than one block. Choosing the wrong mode breaks the system even when the cipher is sound. The four modes below are the ones to know:

Authenticated encryption with associated data (AEAD) produces an authentication tag along with the ciphertext so that tampering is detected. New systems should use an AEAD mode: AES-GCM where AES hardware is available, ChaCha20-Poly1305 where it is not.

The nonce or IV is part of the design. A nonce reused under the same key reuses the keystream, and the one-time pad failure follows: XORing two ciphertexts yields the XOR of the plaintexts. Most real failures of symmetric encryption are ECB, where an authenticated mode was needed, a repeated nonce, or ciphertext that was never authenticated.

Stream Ciphers

A stream cipher generates a keystream from a key and a nonce and XORs it with the plaintext, as a one-time pad would with a pad that a computer can generate. The keystream generator is a CSPRNG, and the cipher’s security is the generator’s security. As with CTR mode, a repeated nonce results in a repeated keystream.

RC4 was the stream cipher of the early Internet. Its keystream is biased, and its misuse in WEP allowed attackers to recover Wi-Fi keys. It is now prohibited in TLS.

ChaCha20 is the modern stream cipher, built from additions, rotations, and XORs on 32-bit words. Those operations run in constant time and use no lookup tables, so it resists timing attacks and is fast on processors without AES hardware. It is used with the Poly1305 authenticator as the AEAD construction ChaCha20-Poly1305, one of the two standard cipher choices in TLS 1.3.

Cryptanalysis of Modern Ciphers

Brute force against a 128-bit key is not feasible. A cryptanalytic attack is any method that recovers the key or plaintext in fewer operations than brute force. Three families have produced results against real ciphers:

A cipher offers \(n\) bits of security when the best attack costs about \(2^n\) operations. Grover’s algorithm on a large quantum computer would halve the effective key length of a symmetric cipher, which is why AES-256 is recommended for long-lived secrets. Symmetric cryptography survives quantum computing with a longer key.

Requirements for a Secure Cryptosystem

A good cryptosystem provides security that survives disclosure of the algorithm, ciphertext that an attacker cannot tell apart from the encryption of any other message of the same length, no shortcut to the key, a key long enough to make brute force infeasible, security under chosen-plaintext and chosen-ciphertext attacks, resistance to side channels, a fresh IV or nonce for every message, and keys that are generated by a CSPRNG and handled carefully. Most of these are properties of the surrounding system rather than of the cipher, and that is where real systems fail.

What You Don’t Need to Study

The lecture notes include the material to establish context and scale that you don’t need to know: