Page 549 - StudyBook.pdf

Basis of Cryptography • Chapter 9 533

Assessing Algorithmic Strength
Algorithmic security can only be proven by its resistance to attack. Since
Head of the Class… attempts to circumvent or break it have occurred. Weak algorithms are
many more attacks are attempted on algorithms that are open to the
public, the longer an algorithm has been open to the public, the more

broken rather quickly, usually in a matter of days or months, whereas
stronger algorithms may be used for decades. However, the openness of
the algorithm is an important factor. It’s much more difficult to break an
algorithm (whether weak or strong) when its complexities are completely
unknown. Thus, when you use an open algorithm, you can rest assured in
its strength. This is opposed to a proprietary algorithm, which, if weak,
may eventually be broken even if the algorithm itself is not completely
understood by the cryptographer. Obviously, one should limit the trust
placed in proprietary algorithms to limit long-term liability. Such scrutiny
is the reason the inner details of many of the patented algorithms in use
today (such as RC6 from RSA Laboratories) are publicly available.

Asymmetric Encryption Algorithms

The biggest disadvantage to using symmetric encryption algorithms relates to key
management. In order to ensure confidentiality of communication between two par-
ties, each communicating pair needs to have a unique secret key.As the number of
communicating pairs increases, there is a need to manage a number of keys related
to the square of the communicators, which quickly becomes a complex problem.
Asymmetric algorithms were developed to overcome this limitation.Also know as
public-key cryptography, these algorithms use two different keys to encrypt and
decrypt information. If cleartext is encrypted with an entity’s public key, it can only
be decrypted with its private key, and if it is encrypted with the private key, it can
only be decrypted by the public key.The basic principle is that the public key can be
freely distributed, while the private key must be held in strict confidence.The owner
of the private key can encrypt cleartext to create cyphertext that can only be
decoded with its public key (assuring the identity of the source), or it can use the
private key to decrypt cyphertext encoded with its public key (assuring the confi-
dentiality of the data).Although these keys are generated together and are mathe-
matically related, the private key cannot be derived from the public key.

www.syngress.com