Cryptography is as strong as the algorithms used to implement it. In modern cryptography, we have the fundamental XOR function, as well as the more complex algorithms used in many applications today. In this blog post, I'll provide an overview of some key algorithms, including Secure Hash Algorithms and the AES algorithm.
Let's start our discussion by defining XOR (exclusive or), a vital logical operation used in various capacities in many, if not all, cryptographic algorithms. Figure 1 shows how this function works. You'll want to understand this function before diving into the algorithms.
Figure 1. This diagram shows how the XOR function works.
Because of the properties of XOR, one of the inputs can be used as a key for data going into the other input. For instance, if A is a single bit of an encryption key, an XOR with a data bit from B flips the bit if A is a 1. This can be reversed by bitwise XOR'ing the encrypted result with the key again.
Now, let's go into more detail on Secure Hash Algorithms, or SHA. A secure hash function takes data of a variable size and condenses it into a fixed-size bit-string output—a concept called hashing. The SHA functions are a family of hashing algorithms that have been developed over time through NIST (National Institute of Standards and Technology) oversight. The SHA-3 function is the latest.
In the next sections, we'll explore how SHA functions work, with a focus on SHA-2 and SHA-3. (SHA-1 is being phased out and is not recommended for any new designs.)
The SHA-2 function has four main types based on output bit length:
- SHA-224 – hash is 224 bits long.
- SHA-256 – hash is 256 bits long.
- SHA-384 – hash is 384 bits long.
- SHA-512 – hash is 512 bits long.
The SHA-3 function has no predefined output length. The input and output lengths have no maximums either. But for comparison purposes with SHA-2, let's define four main types based on output bit lengths. These are:
- SHA3-224 – hash is 224 bits long.
- SHA3-256 – hash is 256 bits long.
- SHA3-384 – hash is 384 bits long.
- SHA3-512 – hash is 512 bits long.
Let's look at SHA3-256 as an example. SHA-3 uses a Keccak sponge function. Just like a sponge, the first step soaks in or absorbs the input message. In the next phase, the output hash is squeezed out. Figure 2 is a block diagram of a SHA3-256 function.
Figure 2. This figure shows a block diagram of the SHA3-256 function for Secure Hash Generation.
The iteration function in Figure 2 takes in the 1600 bits of data and then puts it through 24 rounds of permutation using a specific algorithm and then passes it to the next stage as a 1600-bit block. This continues until the absorbing phase has completed.
Once the absorbing phase has been completed, the last 1600-bit block is passed to the squeezing phase. In this case, since the SHA3-256 output hash length is less than 1088 bits, the squeezing phase does not need any iteration functions. We take the first 256 bits from the last stage and that is the output hash.
For example, if the required hash length was 2500 bits, we would have needed three more instances of the iteration function to get the desired length hash.
There are also algorithms based on encryption standards, such as the Advanced Encryption Standard algorithm. The AES algorithm scrambles and substitutes input data based on the value of an input key in a reversible way, resulting in what is called Ciphertext. Since the AES algorithm is a fixed-width encryption algorithm, the input message is first padded to make sure that it will completely fit in "n" number of 128-bit blocks.
Each 128-bit block is fed into the encryption algorithm along with an encryption key. Depending on the number of bits in the encryption key, the AES algorithm performs a certain number of rounds of obscuring the input block bits. This obscuring is accomplished by shuffling data bits, taking portions of the data and substituting them with values from a look-up table (like a decoder wheel), and performing XOR operations to flip bits from 0 to 1 according to bit values in a set of "round keys" generated from the input encryption key. A round key is used one time for one of the obscuring rounds and is created by "expanding" a portion of the encryption key by copying bits and inserting the copies in-between other bits.
The AES decryption function simply performs the reverse of the operations in the encryption function using the same encryption key in order to unscramble the original input block data.
These are just a few of the cryptographic algorithms that have emerged to provide design security. Learn more about others (including RSA public key cryptosystem, Elliptic Curve Digital Signature Algorithm, and Elliptic Curve Diffie-Hellman key exchange protocol) by reading the tutorial from which this blog post was adapted, "Cryptography: A Closer Look at the Algorithms."
