Security Primitives

The building blocks of every secure protocol as a role-play — SHA-256 digests, AES with a shared key, an RSA key pair, public-key encryption and key wrapping, signatures, HMAC and a Diffie-Hellman key agreement — with an eavesdropper reading the wire and an attacker in the middle trying each one.

Every secure protocol is a combination of a few primitives: TLS, SSH, a signed JWT and a Git commit all use the same handful.

The tool plays them one at a time, with no protocol around them.
Each primitive answers an attack the one before it could not stop.

The names Alice, Bob, Eve and Mallory

Cryptography writes about its parties by name instead of "party A" and "party B", and the names have fixed meanings: a reader who meets Eve knows she only listens.

Alice and Bob are A and B, the two ends that want to talk. Rivest, Shamir and Adleman named them in 1978, in the paper that introduced RSA, and everyone since has kept them.
Eve is the eavesdropper: she reads everything on the wire and changes nothing. An attack that only listens is a passive attack.
Mallory is the malicious attacker: she sits on the wire and can drop, change, replay or make up messages. That is an active attack, and the "man in the middle" is hers.
The cast has more members, all named for their role by their first letter or sound:
- Carol (or Charlie) is a third participant, C. In the tool she is only a name in a message: pay carol 10.
- Trent is a trusted third party, such as the certificate authority that TLS Concepts brings in.
- Peggy and Victor are a prover and a verifier, in proofs that show a secret is known without revealing it.

Reading the drawing

Four parties, one card each:
- Alice and Bob, at the two ends of a wire;
- Eve, who reads the wire: a copy of everything sent lands on her card;
- Mallory, who sits on the wire: what she catches goes on only if she sends it, changed or not.
Objects are documents with their type on the title: a message, a digest, a ciphertext, a wrapped key, a signature, a MAC tag. A click opens or folds one.
An object lies in the card of the party holding it. When it is sent, it flies along an arrow.
Keys have one colour each:
- a solid key (●) is a private key;
- an outline key (◯) is its public half;
- a key marked "shared" (◆) is a symmetric key both ends hold.
What Mallory made is marked in red.
The digests and HMAC tags are the real SHA-256 and HMAC-SHA256 values of the messages shown. The ciphertexts and signatures are fixed stand-ins.

Hashing

A hash function turns any input into a fixed-size digest: SHA-256 gives 32 bytes, whether the input is one line or the 60-page handbook Alice writes in the tool.

The handbook is real: the page writes all 60 pages, and Read it on the document opens them. The digests drawn are its real SHA-256, computed in your browser.
A digest is not a compressed copy, as a zip file is:
- 125 KB of handbook go in and 32 bytes come out, so almost all of the information is gone;
- nobody can rebuild the 60 pages from the digest.
Yet it represents the handbook, because every change gives a different digest:
- one changed character on page 37 (version 4.1.0 to 4.7.0) flips about half of the digest's bits;
- so two equal digests mean two equal files, and comparing 32 bytes replaces comparing 60 pages.
Deterministic: the same input gives the same digest on every machine.
One-way: the only way back from a digest is to guess inputs and hash each.
Keyless: anyone can compute one.

So a digest proves the bytes are the ones hashed, and nothing about who hashed them. In the second scene Mallory points page 37's download address at her own server, hashes the new handbook and sends both on: Bob's check passes.

Shared-key encryption

One key both locks and unlocks: AES, the cipher that moves almost all encrypted data.

Fast: phones run it in hardware.
AES-GCM also detects a changed ciphertext: it fails to decrypt instead of decrypting to garbage.
The key has to reach the other end first, and the wire is the path being protected. Sent over it, the key reaches Eve as well.

Key pairs and public-key encryption

A key pair is two numbers tied by a mathematical relation: what one half does, only the other undoes.

The public half is computed from the private half, never the other way.
Encrypting to a public key needs no shared secret first: anyone locks, only the private half opens.
Each end makes its own pair and publishes the public half: Bob's is blue, Alice's olive.
RSA cannot carry a document:
- it is small: a 2048-bit key locks at most 190 bytes at a time;
- it is slow, measured on a laptop with openssl speed:
  - AES-256-GCM: about 3.8 GB a second;
  - RSA-2048 locking, with the public key: about 10 MB a second, 400 times slower;
  - RSA-2048 opening, with the private key: about 0.3 MB a second, 10,000 times slower.
So it carries only a key (key wrapping): Alice makes a fresh 32-byte shared key, locks it with Bob's public key, and AES with that key carries the 60-page handbook. This is hybrid encryption.
AES carries video the same way: a 4K stream is about 3 MB a second. TLS encrypts the stream with AES-GCM, DRM encrypts the files with AES-128 and wraps the key with public-key cryptography, and video calls use SRTP with AES.

Signatures

A signature runs the key pair the other way: the private half makes it, the public half checks it.

The signer hashes the message and transforms the digest with the private key.
The verifier needs only the public key, and learns two things:
- the holder of the private key made it;
- the message has not changed by a bit since.
Signing hides nothing: the message travels in the clear.
Mallory fails both ways: an edited message no longer matches the signed digest, and her own private key makes signatures that Bob's public key rejects.

Two key pairs and the attacker in the middle

Once Alice makes a key pair of her own, messages go both ways, and each end holds its own private key and the other's public key.

To send to Bob, Alice locks with his public key; to send to Alice, Bob locks with hers.
Each signs with their own private key, and the other checks with the matching public key.
A public key says nothing about whose it is. When the two keys first cross the wire, Mallory sends her own public key to each end in their place:
- she opens what Alice locks, reads it, changes it, and locks it again with Bob's real key;
- she signs the changed message with her own private key, which Bob takes for Alice's.
Every primitive works as designed; the keys are Mallory's. Tying a public key to its owner is the subject of a later post.

HMAC

An HMAC is a hash mixed with a shared key: without the key, nobody can compute the tag.

Checking is computing again, so the checker needs the same key as the maker.
So either end could have made any tag: an HMAC convinces the other end, and nobody else.
It is what HS256 JWTs and many API request signatures use. RS256 and ES256 use a signature.

Key agreement and the attacker in the middle

Key agreement is the alternative to sending the shared key encrypted. In a Diffie-Hellman key agreement each end sends a public key share, and each combines its own private half with the other's public half; both arrive at the same shared key.

Key wrapping: one end makes the key and sends it, encrypted with the other's public key.
Key agreement: both ends compute the key, and only the two shares cross the wire.
No key crosses the wire, and two public halves combine to nothing for Eve.
The private halves are deleted after the connection, so a later theft of a long-term key opens no recorded session (forward secrecy).
A key share says nothing about whose it is. Mallory sends her own share to each end and agrees a key with each, then reads everything she relays.
A signed share stops her: she cannot sign her own share with Bob's private key.
That rests on Alice's copy of Bob's public key being Bob's, the gap the public-key attack used; a later post closes it.

The primitives side by side

Primitive	Keys	Gives	Common names
Hash	none	a fingerprint of the bytes	SHA-256
Shared-key encryption	one, shared	confidentiality	AES-GCM, ChaCha20-Poly1305
Public-key encryption	the recipient's pair	confidentiality with no shared secret	RSA-OAEP
Signature	the signer's pair	who wrote it, and that it is unchanged	RSA-PSS, ECDSA, Ed25519
HMAC	one, shared	unchanged, between the two holders	HMAC-SHA256
Key agreement	a fresh pair at each end	a shared key no one sent	X25519, ECDHE

The primitives on the command line

Each scene can be run by hand with openssl and sha256sum, one step per command, in the series Crypto on the Command Line: