Pro Cryptography and Cryptanalysis with C++23: Creating and Programming Advanced Algorithms 2nd Edition Marius Iulian Mihailescu - Download the ebook now to never miss important information
Pro Cryptography and Cryptanalysis with C++23: Creating and Programming Advanced Algorithms 2nd Edition Marius Iulian Mihailescu - Download the ebook now to never miss important information
com
https://ebookmeta.com/product/pro-cryptography-and-
cryptanalysis-with-c23-creating-and-programming-advanced-
algorithms-2nd-edition-marius-iulian-mihailescu-2/
OR CLICK HERE
DOWLOAD EBOOK
https://ebookmeta.com/product/graphic-design-solutions-6th-edition-
robin-landa/
ebookmeta.com
Bimbo and Cheerleader Gang Breeding 1 Julie Law
https://ebookmeta.com/product/bimbo-and-cheerleader-gang-
breeding-1-julie-law/
ebookmeta.com
https://ebookmeta.com/product/cowl-girls-the-neck-s-best-thing-to-
knit-carron-cathy/
ebookmeta.com
https://ebookmeta.com/product/the-genius-of-japanese-carpentry-
secrets-of-an-ancient-woodworking-craft-azby-brown/
ebookmeta.com
https://ebookmeta.com/product/aerodynamics-for-engineers-6th-edition-
bertin/
ebookmeta.com
Ethical Hacking Techniques and Countermeasures for
Cybercrime Prevention First Edition Nabie Y. Conteh
https://ebookmeta.com/product/ethical-hacking-techniques-and-
countermeasures-for-cybercrime-prevention-first-edition-nabie-y-
conteh/
ebookmeta.com
Marius Iulian Mihailescu and Stefania Loredana Nita
This work is subject to copyright. All rights are solely and exclusively
licensed by the Publisher, whether the whole or part of the material is
concerned, specifically the rights of translation, reprinting, reuse of
illustrations, recitation, broadcasting, reproduction on microfilms or in
any other physical way, and transmission or information storage and
retrieval, electronic adaptation, computer software, or by similar or
dissimilar methodology now known or hereafter developed.
The publisher, the authors, and the editors are safe to assume that the
advice and information in this book are believed to be true and accurate
at the date of publication. Neither the publisher nor the authors or the
editors give a warranty, expressed or implied, with respect to the
material contained herein or for any errors or omissions that may have
been made. The publisher remains neutral with regard to jurisdictional
claims in published maps and institutional affiliations.
This Apress imprint is published by the registered company APress
Media, LLC, part of Springer Nature.
The registered company address is: 1 New York Plaza, New York, NY
10004, U.S.A.
Any source code or other supplementary material referenced by the
author in this book is available to readers on GitHub
(https://github.com/Apress). For more detailed information, please
visit http://www.apress.com/source-code.
Table of Contents
Part I: Foundations
Chapter 1:Getting Started in Cryptography and Cryptanalysis
Cryptography and Cryptanalysis
Book Structure
Internet Resources
Forums and Newsgroups
Security Protocols and Standards
Cryptography Tools and Resources
Conclusion
References
Chapter 2:Cryptography Fundamentals
Information Security and Cryptography
Cryptography Goals
Cryptographic Primitives
Background of Mathematical Functions
One-to-One, One-Way, and Trapdoor One-Way Functions
Permutations
Inclusion
Concepts and Basic Terminology
Domains and Codomains Used for Encryption
Encryption and Decryption Transformations
The Participants in the Communication Process
Digital Signatures
Signing Process
Verification Process
Public-Key Cryptography
Hash Functions
Case Studies
Caesar Cipher Implementation in C++23
Vigenére Cipher Implementation in C++23
Conclusion
References
Chapter 3:Mathematical Background and Its Applicability
Probabilities
Conditional Probability
Random Variables
Birthday Problem
Information Theory
Entropy
Number Theory
Integers
Algorithms inℤ
Integers Modulo n
Algorithms ℤm
The Legendre and Jacobi Symbols
Finite Fields
Basic Notions
Polynomials and the Euclidean Algorithm
Case Study 1:Computing the Probability of an Event That Takes
Place
Case Study 2:Computing the Probability Distribution
Case Study 3:Computing the Mean of the Probability
Distribution
Case Study 4:Computing the Variance
Case Study 5:Computing the Standard Deviation
Case Study 6:Birthday Paradox
Case Study 7:(Extended) Euclidean Algorithm
Case Study 8: Computing the Multiplicative Inverse Under
Modulo q
Case Study 9:Chinese Remainder Theorem
Case Study 10:The Legendre Symbol
Conclusion
References
Chapter 4:Large Integer Arithmetic
A Bit of History
What About Cryptography?
Algorithms Used for Large Integer Arithmetic
Subtraction (Subtraction Modulo)
Multiplication
Big Integers
Review of Large Integer Libraries
Conclusion
References
Chapter 5:Floating-Point Arithmetic
Why Floating-Point Arithmetic?
Displaying Floating-Point Numbers
The Range of Floating Points
Floating-Point Precision
Next Level for Floating-Point Arithmetic
Conclusion
References
Chapter 6:New Features in C++23
Headers
The <expected> Header
The <generator> Header
The <flat_map> Header
Conclusion
References
Chapter 7:Secure Coding Guidelines
Secure Coding Checklist
CERT Coding Standards
Identifiers
Noncompliant Code Examples and Compliant Solutions
Exceptions
Risk Assessment
Automated Detection
Related Guidelines
Rules
Rule 01.Declarations and Initializations (DCL)
Rule 02.Expressions (EXP)
Rule 03.Integers (INT)
Rule 05.Characters and Strings (STR)
Rule 06.Memory Management (MEM)
Rule 07.Input/Output (FIO)
Conclusion
References
Chapter 8:Cryptography Libraries in C/C++23
Overview of Cryptography Libraries
Hash Functions
Public-Key Cryptography
Elliptic-Curve Cryptography (ECC)
OpenSSL
Configuration and Installing OpenSSL
Botan
CrypTool
Conclusion
References
Part II: Pro Cryptography
Chapter 9:Elliptic-Curve Cryptography
Theoretical Fundamentals
Weierstrass Equation
Group Law
Practical Implementation
Conclusion
References
Chapter 10:Lattice-based Cryptography
Advantages and Disadvantages of Lattice-based Cryptography
Applications of Lattice-based Cryptography
Security of Lattice-based Cryptography
Lattice-based Cryptography and Quantum Computing
Mathematical Background
Example
Conclusion
References
Chapter 11:Searchable Encryption
Components
Entities
Types
Security Characteristics
An Example
Conclusion
References
Chapter 12:Homomorphic Encryption
Full Homomorphic Encryption
A Practical Example of Using FHE
Conclusion
References
Chapter 13:Ring Learning with Errors Cryptography
Mathematical Background
Learning with Errors (LWE)
Ring Learning with Errors (RLWE)
Practical Implementation
Conclusion
References
Chapter 14:Chaos-based Cryptography
Security Analysis
Chaotic Maps for Plaintexts and Image Encryption
Rössler Attractor
Complex Numbers:A Short Overview
Practical Implementation
Secure Random Number Generator Using Chaos Rössler
Attractor
Encrypt and Decrypt Using Chaos and Fractals
Conclusion
References
Chapter 15:Big Data Cryptography
Verifiable Computation
Conclusion
References
Chapter 16:Cloud Computing Cryptography
A Practical Example
Conclusion
References
Part III: Pro Cryptanalysis
Chapter 17:Starting with Cryptanalysis
Part III:Structure
Cryptanalysis Terms
A Bit of Cryptanalysis History
Understanding Cryptanalysis Techniques
Analyzing Cryptographic Algorithms
Cracking Cryptographic Systems
Understanding Cryptographic Systems
Understanding Cryptographic Keys
Understanding Cryptographic Weaknesses
Analyzing Cryptographic Keys
Penetration Tools and Frameworks
Conclusion
References
Chapter 18:Cryptanalysis Attacks and Techniques
Standards
FIPS 140-2, FIPS 140-3, and ISO 15408
Validation of Cryptographic Systems
Cryptanalysis Operations
Classification of Cryptanalytics Attacks
Attacks on Cipher Algorithms
Attacks on Cryptographic Keys
Attacks on Authentication Protocols
Conclusion
References
Chapter 19:Differential and Linear Cryptanalysis
Differential Cryptanalysis
Linear Cryptanalysis
Performing Linear Cryptanalysis
Conclusion
References
Chapter 20:Integral Cryptanalysis
Basic Notions
Theorem 20-1 [1, Theorem 1, p.114]
Theorem 20-2 [1, Theorem 2, p.114]
Practical Approach
Conclusion
References
Chapter 21:Brute-Force and Buffer Overflow Attacks
Brute-Force Attack
Buffer Overflow Attack
Conclusion
References
Chapter 22:Text Characterization
Chi-Squared Statistic
Cryptanalysis Using Monogram, Bigram, and Trigram
Frequency Counts
Counting Monograms
Counting Bigrams
Counting Trigrams
Conclusion
References
Chapter 23:Implementation and Practical Approach of
Cryptanalysis Methods
Step 1
Step 2
Step 3
Step 4
Ciphertext-Only Attack (COA)
Known-Plaintext Attack (KPA)
Chosen-Plaintext Attack (CPA)
Chosen-Ciphertext Attack (CCA)
Conclusion
References
Index
About the Authors
Marius Iulian Mihailescu, PhD
is an associate professor at the Faculty of Engineering and Informatics,
Spiru Haret University in Bucharest, Romania. He is also the CEO of
Dapyx Solution Ltd., a company based in Bucharest specializing in
information security and cryptography-related research projects. He is
a lead guest editor for applied cryptography journals and a reviewer for
multiple publications with information security and cryptography
profiles. He authored and co-authored more articles in conference
proceedings, 25 articles, and books. For more than six years, he has
been a lecturer at well-known national and international universities
(the University of Bucharest, Titu Maiorescu University, and Kadir Has
University in Istanbul, Turkey). He has taught courses on programming
languages (C#, Java, C++, Haskell) and object-oriented system analysis
and design with UML, graphs, databases, cryptography, and information
security. He served three years as an IT officer at Royal Caribbean
Cruises Ltd., dealing with IT infrastructure, data security, and satellite
communications systems. He received his PhD in 2014, and his thesis
was on applied cryptography over biometrics data. He holds two MSc in
information security and software engineering.
Internet Resources
The Internet has many resources that are very useful in keeping up
with progress in the field.
Bill’s Security Site (https://asecuritysite.com/). This
website contains various implementations of cryptographic
algorithms. Bill Buchanan, a professor at the School of Computing at
Edinburgh Napier University, created and updated the website.
Books by William Stallings [4] [Stallings, 2010 #1] – Cryptography
and Network Security
(http://williamstallings.com/Cryptography/). The site
contains a significant set of tools and resources and provides regular
updates, keeping up with the most important advances in
cryptography.
Schneier on Security (www.schneier.com/). The website
contains sections with books, essays, accurate news, talks, and
academic resources.
Conclusion
The era in which we are living has an unimaginable evolution and
incredible technologies that enable the instant flow of information at
any time and place. The secret consists of the convergence process of
the computer with the networks, a key force that forces the evolution
and development of these incredible technologies from behind.
Cryptography and cryptanalysis are fascinating disciplines that have
played a critical role in modern communication and security. This step-
by-step work help you get started in the world of cryptography and
cryptanalysis by providing you with all the necessary information to
become an expert in programming and how to approach cryptographic
algorithms. From understanding the basics of programming
cryptography algorithms to exploring advanced techniques, this work
helps you explore the fascinating technical disciplines that have played
a critical role in modern communication and security.
This first chapter discussed the objectives of the book and its
benefits. It covered the mission of the book, addressing the practical
aspects of cryptography and information security and its main
intention in using the current work. The increasing process of using
systems that build using advanced information technologies has been
shown to deeply impact our lives every day. All technologies are
proving to be pervasive and ubiquitous.
The book represents the first practical step of translating the most
important theoretical cryptography algorithms and mechanisms to
practice through one of the most powerful programming languages
(C++20).
This chapter accomplished the following.
Each concept was explained to eliminate the confusion between
cryptography, cryptanalysis, and cryptology.
It discussed the book’s structure. A roadmap introduced the
dependencies of each chapter. Each chapter has been presented in
detail, pointing out the main objective.
A list of newsgroups, websites, and USENETs resources provides
sources covering the latest news in cryptography and information
security.
It introduced the most significant standards used in cryptography
and information security.
References
[1]. Alkim, E., Ducas, L., Pö ppelmann, T., and Schwabe, P. (2016). Postquantum key
exchange—a new hope. In 25th {USENIX} Security Symposium ({USENIX}
Security 16) (pp. 327–343).
[2].
Peikert, C. (2014, October). Lattice cryptography for the Internet. In
international workshop on postquantum cryptography (pp. 197–219). Springer,
Cham.
[3].
Brakerski, Z., Gentry, C., and Vaikuntanathan V. (2011). Fully Homomorphic
Encryption without Bootstrapping Cryptology ePrint Archive, Paper 2011/277,
https://eprint.iacr.org/2011/277.
[4].
Stallings, W., Cryptography and Network Security - Principles and Practice. 5
ed. 2010: Pearson. 744.
[5].
Reddit. Cryptography News and Discussions. Available from:
https://www.reddit.com/r/crypto/.
[6].
Forums, Security.; Available from: http://www.security-
forums.com/index.php?
sid=acc302c71bb3ea3a7d631a357223e261.
[7].
TechGenix, Security. Available from: http://techgenix.com/security/.
[8].
Wilders Security Forums. Available from:
https://www.wilderssecurity.com/.
[9].
Security Focus. Available from: https://www.securityfocus.com/.
[10].
Security InfoWatch. Available from:
https://forums.securityinfowatch.com/ .
[11].
TechRepublic – Security. Available from:
https://www.techrepublic.com/forums/security/.
[12].
Information Security Forum. Available from:
https://www.securityforum.org/.
Footnotes
1 See
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publicati
ons/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?
__blob=publicationFile&v=6
2 See
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publicati
ons/TechGuidelines/TG02102/BSI-TR-02102-2.pdf?
__blob=publicationFile&v=5
3 See
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publicati
ons/TechGuidelines/TG02102/BSI-TR-02102-3.pdf?
__blob=publicationFile&v=5
4 See
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publicati
ons/TechGuidelines/TG02102/BSI-TR-02102-4.pdf?
__blob=publicationFile&v=5
© The Author(s), under exclusive license to APress Media, LLC, part of Springer Nature 2023
M. I. Mihailescu, S. L. Nita, Pro Cryptography and Cryptanalysis with C++23
https://doi.org/10.1007/978-1-4842-9450-5_2
2. Cryptography Fundamentals
Marius Iulian Mihailescu1 and Stefania Loredana Nita1
(1) Bucharest, Romania
Cryptographic history is incredibly long and fascinating. The Code Book: The Secrets Behind Codebreaking [1]
is a comprehensive reference that provides a nontechnical history of cryptography. In the book, the story of
cryptography begins in approximately 2000 BC, when the Egyptians used it for the first (known) time. It
presents the main aspects of cryptography and hiding information for each period that is covered and
describes the great contribution that cryptography had in both world wars. The art of cryptography often
correlates with diplomacy, military, and government because its purpose is to keep sensitive data, such as
strategies or secrets regarding national security, safe.
A crucial development in modern cryptography is the working paper “New Directions in Cryptography”
[2] proposed by Diffie and Hellman in 1976. The paper introduced a notion that changed how cryptography
was seen until then, namely, public-key cryptography. Another important contribution of this paper is an
innovative way of exchanging keys. The security of the presented technique is based on the hardness
assumption (basically, through the hardness assumption, we refer to a problem that cannot be solved
efficiently) of the discrete logarithm problem. Even though the authors did not propose a practical
implementation for their public-key encryption scheme, the idea was presented very clearly and started to
draw attention in the international cryptography community.
The first implementation of a public-key encryption scheme was made in 1978 by Rivest, Shamir, and
Adleman, who proposed and implemented their encryption scheme, currently known as RSA [3]. The
hardness assumption in the RSA is the factoring of large integers. By looking in parallel between integer
factorization for RSA and Shor’s algorithm, we can note that Shor’s algorithm runs in polynomial time for
quantum computers. This represents a significant challenge for any cryptographer using the hardness
assumption for factoring large integers. The increasing applications and interest in the factoring problem led
to new techniques. Important advances in this area were made in 1980, but none of the proposed techniques
improved the security of the RSA.
Another important class of practical public-key encryption schemes was designed by ElGamal [4] in
1985. These are based on the hardness assumption of the discrete logarithm problem.
Other crucial contributions to public-key cryptography are the digital signature, for which the
international standard ISO/IEC 9796 was adopted in 1991 [5]. The basis of the standard is the RSA public-
key encryption scheme. A powerful scheme for digital signatures based on the discrete logarithm hardness
assumption is the Digital Signature Standard, adopted by the United States government in 1994.
Currently, the trends in cryptography include designing and developing new public key schemes, adding
improvements to the existing cryptographic mechanisms, and elaborating security proofs.
The book’s objective is to provide a view of the latest updates of the principles, techniques, algorithms,
and implementations of the most important aspects of cryptography in practice. It focuses on the practical
and applied aspects of cryptography. You are warned about the difficult subjects and those that present
issues and are guided to a proper bibliography in which best practices and solutions are found. Most of the
aspects presented in the book are followed by implementations. This objective also serves to not obscure the
real nature of cryptography. The book represents strong material for both implementers and researchers.
The book describes the algorithms and software systems with their interactions.
From a conceptual point of view, how the information is manipulated did not change substantially. We
consider storing, registering, interpreting, and recording data. However, a manipulation that changed
significantly is copying and modifying the information. An important concept in information security is the
signature, which represents the foundation for more processes, such as nonrepudiation, data origin
authentication, identification, and witnessing.
The requirements introduced by legal and technical skills should be followed to achieve the security of
information in electronic communication. On the other hand, the preceding protection objectives are not
guaranteed to be fulfilled accordingly. The technical part of information security is assured by cryptography.
Cryptography represents the field that studies the mathematical techniques and tools that are connected
to information security, such as confidentiality, integrity (data), authentication (entity), and the origin of
authentication. Cryptography not only provides information security but also provides a specific set of
techniques.
Cryptography Goals
From the security objectives presented in Table 2-1, the following represent a basis from which the others
can be derived.
privacy/confidentiality (Definitions 2.5 and 2.8)
data integrity (Definition 2.9)
authentication (Definition 2.7)
nonrepudiation (Definition 2.6)
The following explains each of the four objectives in detail.
Confidentiality represents a service that protects information content from unauthorized entities and
access. Confidentiality is assured through different techniques, from mathematical algorithms to physical
protection, that scramble the data into an incomprehensible form.
Data integrity represents a service that prevents unauthorized alteration of the information. Authorized
entities should be able to discover and identify unauthorized manipulation of data.
Authentication represents a service that has an important role when data or application is authenticated,
and it implies identification. The authentication process is applied on both extremities that use the data
(for example, the sender and the receiver). The rule is that each involved party should identify itself in the
communication process. It is very important that both parties that are involved in the communication
process declare to each other their identity (the parties could be represented by a person or a system). At
the same time, some characteristics of the data should accompany the data itself; for example, its origin,
content, or the time of creation/sending. From this point of view, cryptography branches authentication
into two categories: authentication of the entity and authentication of the data origin. Data origin
authentication leads to data integrity.
Nonrepudiation represents a service that prevents the denials of previous actions made by an entity.
When a conflict occurs because an entity denies its previous actions, it is resolved by an existing sinew
showing the actions made over data.
One of the main goals of cryptography is to fulfill the four objectives on both sides—theory and practice.
Cryptographic Primitives
The book presents several fundamental cryptographic tools called primitives. Examples of primitives are
encryption schemes (Definitions 2.5 and 2.8), hash functions (Definition 2.9), and schemes for digital
signatures (Definition 2.6). Figure 2-1 presents a schematic description of these primitives and their
relationship. Many cryptographic primitives are used in the book, and practical implementations are
provided every time. Before using them in real-life applications, the primitives should be evaluated to check
if the following criteria are fulfilled.
Level of security. It is slightly difficult to quantify the level of security. However, it can be quantified as
the number of operations to accomplish the desired objective. The level of security is usually defined
based on the superior bound given by the volume of work necessary to defeat the objective.
Functionality. To accomplish security objectives, in many situations, primitives are combined. You need
to be sure that they work properly.
Operation methods. When primitives are used, they need different inputs and have different ways of
working, resulting in different characteristics. In these situations, the primitives provide very different
functionalities that depend on the mode of operation.
Performance. This concept is related to the efficiency that a primitive can achieve in a specific mode of
operation.
Ease of implementation. This concept is merely a process rather than a criterion, which refers to the
primitive being used in practice.
Figure 2-1 Cryptographic primitive taxonomy
The application and the available resources give importance to each of the criteria shown in Figure 2-1.
Cryptography may be seen as an art practiced by professionals and specialists who proposed and
developed ad hoc techniques whose purpose was to fulfill important information security requirements. In
the last few decades, cryptography has transitioned from an art to a science and discipline. There are
dedicated conferences and events in many cryptography and information security fields. In addition, there
are international professional associations, such as the International Association for Cryptologic Research
(IACR), whose aim is to bring and promote the best research results in the area.
The current book is about cryptography and cryptanalysis: implementing algorithms and mechanisms
using C++ with respect to standards.