L0010 Intro to Cryptography
Cryptography secures communication by converting information into an unreadable format. OpenSSL je the most popular cryptography library. When we connect to HTTPS websites, secure email servers, secured databases or VPN connections, we are most likely using OpenSSL.
We can use OpenSSL as an application library, or we can use it through its command-line interface.
Cryptography Techniques
One-Way Function
![]() | If you spill milk, it's very difficult to collect it. If you break a plate, it's almost impossible to put the pieces back together. One-way functions are like that. It's easy to make a change, but it's not easy to undo it. If it is easy to calculate " y=f(x)", but it is difficult to calculate "x=f-1(y)", then we have one-way function. There are two important types of one-way functions:1) one-way functions where solving the reverse function is impossible task. 2) one-way functions where we can easily reverse the change if we know a secret piece of information. These are so-called trapdoor functions. |
Hash Function
Hash function is an example of the irreversible function.
| A hash function takes some data and transforms it into a result that has specific characteristics. The result is called hash code (or digest). | 'Good morning' -> 'hkx8' | 'Bonjour' -> 'zbt2' | 'Dobro jutro' -> 'kskm' |
These are the qualities of good hash function:
| 1) Function is one-way. It is impossible to reconstruct data from the hash code. | 'hkx8' -> 'Good morning' # not possible |
| 2) Function is deterministic. Same input always gives the same output. | 'Bonjour' -> 'zbt2', 'Bonjour' -> 'zbt2' #each time |
| 3) Small change in input creates a huge change in output. | 'Bonjour' -> 'zbt2', 'Zonjour' -> 'qptm' #totaly different code |
| 4) Probability for two same results, for different arguments, is small. | 'Bonjour' -> 'ZBT2', 'Buongiorno' -> 'ZBT2' #unlikely |
| 5) Hash code will be small ( ~ 1 KB ), and always of the same size. This makes it practical and standardized for different tools to use it. | 'hkx8', 'zbt2', 'kskm' # always 4 characters |
| 6) If we have a text and a hash, we can not easily find some other text that would have the same hash. | 'Bonjour' -> 'zbt2' # it is hard to find other message with the same hash |
| 7) Hash can be calculated quickly and easily. |
I'll give you an example of a simple, but bad hash function. This function will replace each letter with the number of its position in the alphabet. It will add those numbers together and take the last digit from the result. It has many of the qualities listed above. In the example below, we can see that it lacks quality number 4).
A p p l e | O r a n g e | Hash for the word "Apple" is 0, and hash for the word "Orange" is 0, too. |
Other names for hash are Checksum, Fingerprint or Digest. We can use hash to label and recognize some data.
Trapdoor Function
Let's say we have two prime numbers. I'll use "p = 47" and "q = 59". If we multiply them, we get "2773". If I tell you that my number is "2773" and that this number is the product of two prime numbers, will it be feasible for you to find the two numbers?
You can use a computer to try to find a number that divides "2773". The brute force approach will always work, but only if the number is small enough. If the number is larger, even a computer won't help you.
The solution is to get a secret key from me. If I tell you that the value of "p" is "47", then you can easily calculate that "q = 2773 / 47 = 59". This makes this multiplication easy to inverse, but only if you have the secret key.
Encryption
Encryption is a way of scrambling data so that only authorized parties can understand the information. Here are some examples. Only the person who has the key will be able to read these encrypted messages.
Substitution Encryption
| I will write two phrases. | The Big Bang | The Raising Sun |
I will use "Webding" font for these phrases. |
This is simple substitution encryption. Each letter is replaced with a different graphical sign.

XOR Encryption
| I will write the number 14 using its binary representation. | 1110 # zero is representing FALSE and one is representing TRUE |
| This will be my password. I will again use binary syntax. | 0011 # zero is representing FALSE and one is representing TRUE |
| XOR operator is working by this logic. Only if arguments are different, it will return TRUE. | XOR( FALSE, FALSE ) | XOR( TRUE, TRUE ) | XOR( FALSE, TRUE ) | XOR( TRUE, FALSE ) |
| FALSE | FALSE | TRUE | TRUE |
| We can combine the number 1110 and password 0011 with XOR operator, to encrypt the number. Encrypted number will be 1101. | XOR( 1, 0 ) | XOR( 1, 0 ) | XOR( 1, 1 ) | XOR( 0, 1 ) |
| 1 | 1 | 0 | 1 |
I will now show you how to use hashing and encryption with OpenSSL.
OpenSSL
OpenSSL Installation
I am using Ubuntu as my operational system. Let's see if the OpenSSL is already installed. Usually, it is.
openssl version | |
![]() | We can add option "-a" to get more information about OpenSSL.If your system doesn't have OpenSSL, you can easily install it with this line: sudo apt install openssl |
OpenSSL Commands
This is how we can list all of the OpenSSL commands. openssl list -commands This will show us all of the Standard, Digest and Cipher commands. It is also possible to limit this output to only those commands that interest us. openssl list -standard-commands openssl list -digest-commands openssl list -cipher-commands | ![]() |
For specific command we can get help like this: openssl dgst -help | ![]() |
OpenSSL Man Pages
We can get Man pages for OpenSSL with this command. man openssl For specific command we can see Man pages like this: man openssl-dgst | ![]() |
OpenSSL Hashing
I will first create one file, and I will place it on the Desktop. seq 100 > /home/fff/Desktop/sequence1.txt This file will contain numbers 1-100, although the content is not important. | ![]() | I will also create another version of this file that will have the number "9999" in the first line. I will name it "sequence2.txt". | ![]() |
For hash creation, we will use "dgst" command. We can see on the image the hash that was created. We can run this command several times and each time we will get the same result. The hashing algorithm is deterministic.
cd /home/fff/Desktopopenssl dgst -sha256 sequence1.txt | ![]() |
Currently we have files "sequence1.txt" and "sequence2.txt". They are almost the same. But their hashes will not be similar, they will be totally different. openssl dgst -sha256 sequence2.txt | ![]() |
All of the hashes will be of the same size, 64 hexadecimal characters. echo -n "Hello, World!" | openssl sha256 | ![]() |
Hash Algorithms
We are using the command "dgst" to create a hash. We can also provide the hash algorithm. There are many algorithms, we used "sha256" algorithm. We can get the list of hash algorithms with this command: openssl list -cipher-algorithms | ![]() |
OpenSSL Encryption
This command will encrypt the file "sequence1.txt" by using "-aes-256-cbc" algorithm. We will be asked to enter our password twice. openssl enc -aes-256-cbc -in sequence1.txt -out sequence1.enc | ![]() |
Notice that we are getting a warning to use "-iter" or "-pbkdf2". To encrypt data, AES algorithm must use 256-bit key, so the first step is to transform our password into this key, using hash algorithm. Transformation of the password into key is much more randomized if we use "-pbkdf2" option. We should always use it.
Salt
The hacker can create a collection of the most often used passwords. He can then use those passwords to brut force encrypted files. Because passwords are usually short, checking each password will only take a fraction of time. Our goal is to make this process more expensive.
Solution is to make passwords longer and more random. This can be done with a "salt". Salt is a random string that is concatenated to a password. Instead of the password being "pass123", now it will become "pass123KX8G#A". AES-256 key will be calculated by hashing this salted password.
Beside that, usage of "-pbkdf2" means that creation of AES-256 key takes more computational power. Thanks to salt and "pbkdf2", a hacker will need a few seconds to check each password. That will make impossible for him to brut force the password.
But who will provide the salt during the file decryption? The answer is that salt string "KX8G#A" will be saved together with an encrypted file. The "salt" itself is not encrypted. Anyone, who has encrypted file, can read the salt. When the user tries to decrypt the file, his password will be combined with a salt to generate salted password, that will be used for decryption.
Now, that we now about "-pbkdf2" and "-salt" we should add them to our command.
openssl enc -aes-256-cbc -pbkdf2 -salt -in sequence1.txt -out sequence1.enc # the old file will be overwritten |
Encrypted File
![]() binary file | The result of the "enc" command will be a binary file. We can choose to generate "base64" encrypted file, if we use "-a" option.openssl enc -aes-256-cbc -pbkdf2 -salt -a -in sequence1.txt -out sequence1base64.encNow, our file is textual file, we can copy-paste it anywhere => | ![]() |
OpenSSL Decryption
For decryption we have to use "-d" option. openssl enc -d -aes-256-cbc -pbkdf2 -in sequence1.enc -out sequence1decr.txt | Because the key was created with "-pbkdf2" option, we must use it during the decryption. |
This command will confirm that there is no difference between the original and decrypted file. diff sequence1.txt sequence1decr.txt |
Above, we decrypted binary file. For decrypting "base64" file we have to use "-a" option. openssl enc -d -aes-256-cbc -pbkdf2 -salt -a -in sequence1base64.enc -out sequence1base64.txt |
Encryption Algorithms
This is how we can find the list of all of the encryption algorithms. openssl list -cipher-algorithms | ![]() |
Symmetric vs Asymmetric Keys
![]() | When we used "enc" OpenSSL command, we only provided privacy. It is the same as if the users exchanged their files inside of the encrypted ZIP file.This kind of encryption is based on the symmetric keys, because there is a password that must be known by both of the parties. |
For authentication, we must use asymmetric keys. In that case, there are two keys. One is the private key; the other is the public key. The private key is something that we hide and don't share with others. A person can use the private key to identify themselves.
To understand how private/public keys are related and generated, we'll look at the mathematics of the RSA algorithm for creating asymmetric keys. This isn't something we have to know, but it's really interesting to know.
RSA Algorithm
We will start by choosing two random prime numbers. I will choose 3 and 11. We will label them with P = 3 and Q = 11.
From P and Q we will calculate their product and their "Totient". "Totient" is a special mathematical property. | P | Q | N ( Product ) | T ( Totient ) |
| 3 | 11 | P * Q = 3 * 11 = 33 | ( P – 1 ) ( Q – 1 ) = 2 * 10 = 20 |
Public Exponent "E"
P and Q will help us find E (the public exponent) and D (the private exponent). First, we will choose a public exponent. The public exponent must satisfy conditions below. The number 7 satisfies all of these conditions, so that will be our public exponent.
1) The public exponent E must be a prime number. 7 is a prime number.
2) It must be less than Totient ( 7 < 20 ).
3) Totient cannot be divided by the public exponent ( 20 / 7 = 2,857 ).
Private Exponent "D"
| For private exponent "D" there is only one condition. This equation must be satisfied: " MOD( D * E, T ) = 1".There are many values for D that will satisfy this condition. | D = 3 | MOD( 3 * 7, 20 ) = 1 |
| D = 23 | MOD( 23 * 7, 20 ) = 1 | |
| D = 43 | MOD( 43 * 7, 20 ) = 1 | |
| D = 63 | MOD( 63 * 7, 20 ) = 1 |
Each time we increase the number D by +20, we get a candidate. I will use the smallest number D = 3.
RSA Encryption
I will encrypt number "16". | MOD( 16 ^ D, N ) = MOD( 16 ^ 3, 33 ) = 25 | The number "16" encrypted is "25". |
RSA Decryption
I will decrypt number "25". | MOD( 25 ^ E, N ) = MOD( 25 ^ 7, 33 ) = 16 | The number "25" decrypted is "16". |
For encryption, we need to know the private key. For decryption, we only need to know the public key. This property will help us use asymmetric keys for authentication.
Some Consideration for RSA Math
Modulus
When doing encryption and decryption we use Modulus function. We write Modulus function like this MOD(). This is the syntax that we use in spreadsheet programs. In mathematics we use different syntax:
| MOD( 16 ^ D, N ) = 16 ^ D MOD N | This is the reason why in RSA terminology "Modulus" is a name for the number N. When we say "Modulus", we mean the number N. |
| MOD( 25 ^ E, N ) = 25 ^ E MOD N |
Private and Public Key
For encryption we need private exponent D and Modulus N. Together they make a private key ( D, N ).
Similar to that, for decryption we need public exponent E and Modulus N. Together they are a public key ( E, N ).
Public Key is Derived from Private Key
This is something we hear often in lessons about cryptography. This is not true for RSA keys. For RSA keys, both keys are calculated based on the secret values for P and Q.
Every Asymmetric Key is Using One Way-Function
But where is the one-way function in the RSA algorithm? Let's say that the hacker knows the public key ( E, N ), and he wants to find the private key ( D, N ). Public key is not something that is a secret, only private key is secret.
| Private key depends on Totient T. MOD( D * E, T ) = 1 | Totient T depends on P and Q. ( P – 1 ) ( Q – 1 ) | P and Q are factors of Modulus. P * Q = N | In the encryption example above we already saw that it hard to find P and Q, even with the help of a computer. |
Modulus is calculated by the one-way function. It is easy to calculate N = f( P, Q ), but it is hard to calculate ( P, Q ) = f-1( N ).
RSA Keys are Commutative
We can do encryption with private exponent D = 3, and we can do decryption with public exponent E = 7. It is also possible for them to reverse their roles. We can encrypt with 7, and decrypt with 3. This is something that is unique for RSA asymmetric keys.





















































































































