7. The Bedrock of Cybersecurity: Cryptography 181 used, so these techniques are not guaranteed to go unnoticed, but they can be highly effective for smuggling information out of networks and for communicating in secret over open channels. One caveat, however, should be noted: if a stego technique involves outof-the-ordinary communication patterns, it could tip observers off that something “fishy” might be going on. For example, if Alice and Bob start emailing innocent-looking images to one another out of the blue for no apparent reason, it could arouse suspicion and invite further investigation. Ideally, steganography should be incorporated into existing and routine methods and patterns of communication. Because of its complete dependence on security by obscurity, using steganography can be risky. If the steganographic technique is exposed, then the secret message is divulged. For extra insurance, steganography and cryptography can be used together. In another of Poe’s short stories, “The Gold Bug,” a treasure map is written in invisible ink (steganography), and the text on it is encrypted with a monoalphabetic cipher (cryptography). Once the plaintext is finally revealed, it is a riddle that must be solved to find the hidden treasure—yet another layer of insurance! 7.4 Principles of Cryptography “Few false ideas have more firmly gripped the minds of so many intelligent men than the one that, if they just tried, they could invent a cipher that no one could break.” - The Codebreakers by David Kahn This section outlines a few guiding principles for cryptography based on lessons learned over its long history. 7.4.1 Kerckhoffs’s Principle “The enemy knows the system.” - Claude Shannon’s summary of Kerckhoffs’s principle Auguste Kerckhoffs studied military cryptography in Europe in the 1800s. He outlined a counter-intuitive principle that became known as Kerckoffs’s principle that still guides cryptography today. The principle states that it should be assumed that the enemy knows and has access to the cryptographic system being used. For this reason, cryptosystems should be parameterized with a secret value, a key, and the security should reside entirely in the secrecy of the key. Steganography depends entirely on security by obscurity in direct violation of Kerckhoffs’s principle. The difference is that steganography counts on concealing the presence of the secret communication, while cryptography assumes that eavesdroppers will observe and intercept the ciphertext and attempt to cryptanalyze it to reveal the message. This is called a ciphertext-only attack. Kerckhoffs was primarily concerned with how cryptography is actually implemented and used in the real world. He realized that cryptosystems inevitably fall into enemy hands. This can happen due to mistakes, espionage, capture, or to reverse engineering. When
RkJQdWJsaXNoZXIy MTM4ODY=