Introduction to Cryptography and Encryption
Cryptography hides and binds data so that an adversary can neither read it nor change it unnoticed. This domain is largely vocabulary and service mapping: which primitive delivers which guarantee, what a key length actually buys, and why encoding, obfuscation and steganography are not encryption. Expect definition items, service-mapping items and key-space arithmetic.
Core rules
- Kerckhoffs's principle: the algorithm may be public; secrecy lives in the key.
- Encryption gives confidentiality only. Integrity and authenticity require a MAC or a signature; unauthenticated encryption still permits bit-flipping and padding oracles.
- Symmetric cryptography uses one shared key and is fast; n parties need n(n-1)/2 keys. Asymmetric cryptography uses a key pair, is slow, and shifts the problem to authenticating the public key, which is what PKI does.
- Shannon's confusion (substitution, breaking the key-ciphertext link) and diffusion (permutation, spreading one plaintext bit across the ciphertext).
- The one-time pad is the only information-theoretically secure cipher, and only with a truly random key as long as the message, never reused and never exposed.
- Strength is expressed in bits: brute-force cost is about 2^n operations.
Worked example
A legacy cipher has a 56-bit key and the attacker tests 10^9 keys per second. 2^56 is about 7.2 x 10^16 keys, so exhaustive search takes roughly 7.2 x 10^7 seconds, about 833 days, halved to roughly 417 days on average. Moving to 112 bits multiplies the work by 2^56, far beyond feasibility. The lesson is that the key space, not the algorithm's reputation, sets the security level.
Traps that cost marks
Base64 or hexadecimal output is encoding, not encryption. Repeating-key XOR is a Vigenere-style stream and falls to frequency analysis. Hashes are one-way and do not encrypt. 'Encrypted' does not mean 'integrity-protected'. Vague descriptors such as 'military-grade' carry no technical meaning.