In order to unpack what the future of encryption may hold, we decided to first document the past.
"Dance like no one is watching, encrypt like everyone is" - Werner Vogels
Firstly, an important distinction:
Cryptography is the practice & study of techniques of secure communication in the presence of adversarial behaviour.
Encryption is the process (& in many ways, art) of scrambling data so that only authorised parties can understand the underlying information. So yes, encryption is a subset of cryptography.
In and around 100BC Julius Caesar was passing secret messages around Caput Mundi via a relatively simple substitution “cipher” (ie encrypt/decrypt function) now known as the “Caesar Cipher”. This was a relatively simple “shift-by-three” cipher. Meaning that the letter “A” would be substituted with the letter “D”, the letter “X” would be substituted with “A”, etc.
What’s pertinent here is that Caesar Cipher is rule-based encryption. Once someone knows the rules of the game they can easily decrypt the “ciphertext” (encrypted text) into “plaintext” (decrypted text).
Astute readers will note that if letters such as “D” or “L” appear frequently in Caesar’s ciphertext, that these letters likely map to plaintext vowels (A and I respectively).
Similarly, readers may look for common bigrams (sequences of letters) in words such as: NG, ST, QU, etc. This strategy is known as “frequency analysis”. Not exactly an unbreakable code.
As a result, modern encryption tends to rely on what’s known as an “encryption key” (or keys) which stems from the work of ~Blaise de Vigenère in the 16th century.
Encryption keys are a hard-to-guess string of letters, numbers and symbols such as: b'VQfCNh**72dvh that, when combined with a secret message, produce a unique output.
Below I used the python `cryptography` library to:
Note: When a single encryption key is used to both encrypt & decrypt data this is known as “symmetric encryption”.
When alternate keys are used to encrypt (public key) and decrypt (private key) data this is known as “asymmetric encryption”.
Vigenère used symmetric encryption to make his cipher “polyalphabetic” — whereby each plaintext character (e.g., “C”) was combined with an encryption key character (e.g., “H”) in order to “generate” a character (“J”) from a specific alphabet.
Example below:
However, this method and its 19th/20th century successors (including the German Enigma rotor machine!) once again eventually fell short when frequency analysis was used.
Fast-forward to the 1970s and IBM designed a cipher (remember, an encrypt/decrypt function) named Lucifer. Soon after, the cipher was adopted by NIST (National Institute of Standards & Technology) as a US national standard and (thankfully) renamed to the Data Encryption Standard, or “DES”.
Elsewhere in the 1970s (1976) asymmetric encryption (remember, public and private keys) began to bloom thanks to Whitfield Diffie & Martin Hellman. The advent of asymmetric encryption marked the dawn of “modern” cryptography.
Key Point: Thanks to asymmetric encryption, parties no longer need a shared secret (encryption key) to securely communicate.
Alice can share her public key with Bob in order to encrypt a “secret message” from Bob, but she never has to share her private (decryption) key with him.
Shortly after (1977), fuelled by Manischewitz (worth looking into), Rivest, Shamir and Adleman released the RSA asymmetric cipher. Yes… like the conference. RSA is the most popular / widely understood asymmetric encryption system to date.
However, the incentive to create new problems in cybersecurity is high. Come 1997, DES was cracked. Symmetric encryption needed a new saviour.
How was it cracked? Well, thanks to “Moore’s Law” clock speeds improved. This meant that via sheer brute-force computation (ie trying every possible solution), malicious actors could correctly guess a 56-bit DES encryption key, and hence, access an underlying message.
Thus, in 1997, another RFP was published by NIST for a new national standard. By 2000, a new cipher was adopted known as Rijndael (pronounced rain-dahl) or the Advanced Encryption Standard.
Without getting into the mathematical weeds, one of AES’ main advantages is that it offers 128-bit, 192-bit or 256-bit encryption keys.
For context, even with a supercomputer, it would take 1 billion billion years to crack a 128-bit AES key using brute force attack.
But what about quantum? A fair question — quantum is/was a very real threat.
As a result, in 2016, NIST… you guessed it, put out another RFP for cryptographers to devise and then vet encryption methods that could resist an attack from future quantum computers.
In July ‘22 the first four quantum-resistant algorithms (thank you lattices) were announced (!) which I’m, naturally, paying quite a bit of attention to, but are well-beyond the scope of this historic account.
