Cryptography History: From Secrecy to Public Key Encryption

Modern secure communications combine both symmetric and asymmetric encryption in a hybrid approach. The process begins with asymmetric encryption to securely exchange a symmetric encryption key. For example, in TLS/SSL protocols, the server initially sends its public key (as part of a certificate). The client then generates a random symmetric key, encrypts it using the server's public key, and sends it back. Both parties then use this shared symmetric key for all subsequent communications. This hybrid approach leverages the strengths of both systems: asymmetric encryption provides secure key exchange, while symmetric encryption enables fast, efficient communication of large amounts of data.

Hybrid encryption combines symmetric and asymmetric encryption: asymmetric for secure key exchange (secure but slow), symmetric for bulk data encryption (fast but requires secure key exchange). This provides both security and efficiency. TLS/SSL (Transport Layer Security) is the foundational security protocol for internet communication, encrypting web traffic. The TLS handshake process includes: TCP three-way handshake, Client Hello (supported algorithms), Server Hello (certificate with public key), certificate verification, session key exchange (client generates symmetric key encrypted with server's public key), and session establishment. After handshake, both parties use the shared symmetric session key for efficient data transfer.

Modern secure web communication combines symmetric and asymmetric encryption through the TLS/SSL handshake: (1) Browser requests TLS and supported algorithms; (2) Server sends SSL certificate with public key, verified by trusted Certificate Authorities; (3) Browser generates symmetric session key, encrypts it with server's public key; (4) Server decrypts with private key; (5) Both parties share the same symmetric key for efficient data encryption. This hybrid approach provides secure key exchange (asymmetric) followed by fast data transfer (symmetric). The lock icon in browsers confirms successful authentication.

Hybrid encryption combines the strengths of both asymmetric and symmetric encryption. Asymmetric encryption is used to securely exchange a symmetric key (which is computationally efficient), while symmetric encryption handles bulk data transfer efficiently. This approach is used in SSL/TLS, IPsec, and SSH protocols to achieve both secure key exchange and efficient data protection.

Hybrid encryption combines symmetric and asymmetric encryption for efficient secure communication. During TLS/SSL handshake, the browser and server negotiate supported algorithms. The server generates a temporary session symmetric key and encrypts it using its private key. The browser decrypts this using the server's public key, obtaining the session key. All subsequent communication uses fast symmetric encryption with this session key, which is deleted after the session ends.

Public Key Infrastructure (PKI) is a system that enables secure digital communication through asymmetric encryption, using key pairs (public and private keys) where each party generates their own keys; a trusted Certificate Authority (CA) acts like a digital notary to issue and verify digital certificates containing public keys and identity information; digital signatures are created by hashing data and encrypting the hash with the sender's private key, allowing the recipient to verify both the sender's identity and data integrity by decrypting the hash with the public key and comparing it with a newly computed hash of the received data.

Public Key Infrastructure (PKI) is a trusted system that stores public keys for all parties, enabling secure communication through asymmetric encryption where senders encrypt messages with the receiver's public key and receivers decrypt with their private key. Digital certificates, issued by Certificate Authorities, bind public keys to identities and enable digital signatures where senders sign documents with their private key and receivers verify authenticity using the sender's public key. The verification process always occurs before decryption: the receiver first verifies the digital signature, then decrypts the message.

Public Key Infrastructure (PKI) is the system that enables secure digital signatures on the internet. It involves certification authorities (CAs) that issue digital certificates binding public keys to identities. A certificate contains a public key, identity information, and a digital signature from the CA. When verifying a certificate, the recipient hashes the certificate content, applies padding schemes, decrypts the signature with the CA's public key, and compares results to confirm validity.

Digital signatures ensure authenticity, integrity, and non-repudiation through asymmetric cryptography: sender hashes the message, encrypts the hash with their private key, and recipient verifies using the sender's public key. Public Key Infrastructure (PKI) enables secure communication using public/private key pairs through digital certificates (X.509 standard) binding identities to public keys. Certificate Authorities (CAs) issue and sign certificates, while Registration Authorities (RAs) verify identities. Certificate management includes validation levels (Domain, Organization, Extended Validation), revocation mechanisms (CRL lists, OCSP real-time verification), and trust models (hierarchical, cross-certification, peer-to-peer, bridge CA). PKI is essential for HTTPS websites, email encryption, smart cards, and VPNs.

Public Key Infrastructure (PKI) is a cryptographic system that uses asymmetric cryptography, involving a pair of mathematically related keys—one public key that can be freely shared and one private key that must be kept secret—to solve the key distribution problem in symmetric encryption; PKI works through digital certificates issued by trusted Certificate Authorities (CAs), which bind a public key to an entity's identity and use digital signatures (created by hashing certificate data and encrypting it with the CA's private key) to establish a chain of trust, enabling secure communication over untrusted networks like the internet.

Post-Quantum Cryptography (PQC) is a new encryption standard developed by NIST to protect digital communications from quantum computer attacks, which can break current encryption methods like RSA and Elliptic Curve in minutes instead of millions of years; organizations must begin implementing PQC immediately because attackers can already harvest encrypted data today and decrypt it later when quantum computers become powerful enough, with a hard deadline of 2030-2035 for full transition.

Pre-shared keys are already quantum-safe, which is why they are used in IKE version 1 and have been added to other protocols. The IETF is working on protocols to integrate quantum-safe structures into existing protocols like TLS and IKE. These protocols need to support larger cryptographic artifacts, including larger keys and certificates. Several post-quantum cryptography algorithms have been standardized by NIST: FALCON (key encapsulation mechanism) and Dilithium, SPHINCS+ (digital signature algorithms). These algorithms are based on different underlying hard problems that are resistant to both classical and quantum attacks. The ecosystem is still developing, with NIST standards being recent and protocol implementations still being developed.

In 2016, NIST launched a competition to find cryptographic algorithms resistant to both classical and quantum computers. After testing 82 proposals, NIST selected four algorithms on July 5, 2022. Three are based on lattice mathematics: given basis vectors R1 and R2, find the integer combination that reaches the lattice point closest to a target point C. While easy in 2D, this becomes extremely difficult in 1000 dimensions because taking a step in the correct direction in one dimension might mean wrong steps in the other 999 dimensions. For encryption, the sender finds the closest lattice point to the message, adds random noise, and the recipient uses their secret basis vectors to find the closest lattice point and decrypt.

Signal Foundation has developed PQXDH (Post Quantum Extended Diffie Helmen), a quantum-resistant encryption protocol that augments existing ECC cryptography with Crystal's Kuiper protocol, providing security equivalent to AES by requiring attackers to break both encryption schemes simultaneously; this update is critical because quantum computers can efficiently solve discrete logarithm and integer factorization problems using Shor's algorithm, threatening current asymmetric cryptography that relies on mathematical functions easy to compute but hard to reverse, with IBM's quantum processors already reaching 433 qubits and expected to exceed 1,000 qubits soon.

Two approaches address quantum threats: quantum key distribution (using quantum mechanics for secure key exchange where any interception is detectable) and post-quantum cryptography (algorithms resistant to quantum attacks). Post-quantum cryptography is more practical as it can be implemented with existing hardware. While no system is 100% secure, post-quantum methods provide significantly better protection against future quantum computers.