Skip to main content

Network Security, Cryptography, and Symmetric vs Asymmetric Ciphers

🎓 SS3 | 📅 Term 1 • Week 7

| ⏱ About 45 minutes

Learning goals: Deconstruct the CIA Triad of information security: Confidentiality, Integrity, and Availability. • Compare Symmetric Key Cryptography (AES-256) with Asymmetric Key Cryptography (RSA). • Analyze Cryptographic Hash Functions (SHA-256) and their collision-resistant properties. • Explain Digital Signatures, Public Key Infrastructure (PKI), and SSL/TLS Certificates.

Lesson menu On this page

Every second of every day, billions of dollars move across international bank networks, secret diplomatic messages traverse satellites, and millions of Nigerians make debit card payments and log into email accounts.

All of this happens over the open, public internet—a network where wires, fiber optic cables, and Wi-Fi routers can be monitored by attackers.

How can you send your debit card PIN or confidential school records across thousands of miles of public copper and airwaves without an eavesdropper reading it?

The science that protects digital civilization is Cryptography and Network Security. In this lesson, we study the CIA Triad, master Symmetric vs Asymmetric Encryption, understand Cryptographic Hashing, and inspect Digital Signatures.

---

Learning Outcomes

By the end of this lesson, you will be able to:

1. Apply the CIA Triad of Information Security: Confidentiality, Integrity, and Availability.
2. Compare Symmetric Ciphers (AES) with Asymmetric Public-Key Ciphers (RSA).
3. Analyze Cryptographic Hash Functions (SHA-256) and observe the Avalanche Effect.
4. Trace Digital Signatures and Public Key Infrastructure (PKI) in HTTPS web security.

---

Key Vocabulary

Term	Technical Definition
Cryptography	The mathematical science of transforming plain text into unintelligible ciphertext to protect data secrecy and authenticity.
Ciphertext	The scrambled, encrypted output produced by an encryption algorithm using a cryptographic key.
Symmetric Encryption	A cryptographic method where the identical shared secret key is used to both encrypt and decrypt data (e.g., AES-256).
Asymmetric Encryption	A system utilizing a mathematically related pair of keys: a Public Key (freely distributed) and a Private Key (kept secret).
Hash Function	A one-way mathematical algorithm that converts arbitrary data into a fixed-length string of bits (e.g., SHA-256).
Digital Signature	A mathematical mechanism that binds an identity to digital data using asymmetric cryptography, guaranteeing authenticity and non-repudiation.

---

The CIA Triad of Cybersecurity

Every security policy, firewall, and cryptographic algorithm protects one or more pillars of the CIA Triad:

                     ┌───────────────────┐
                     │  CONFIDENTIALITY  │
                     │  (Secrecy / AES)  │
                     └─────────┬─────────┘
                               │
                               │
            ┌──────────────────┴──────────────────┐
            │                                     │
┌───────────┴───────────┐             ┌───────────┴───────────┐
│       INTEGRITY       │             │     AVAILABILITY      │
│  (Tamper-Proof Hashing)│             │ (Redundancy / Uptime) │
└───────────────────────┘             └───────────────────────┘

1. Confidentiality: Preventing unauthorized individuals from reading data. (Tool: AES-256 Encryption)
2. Integrity: Ensuring that data cannot be altered or corrupted in transit without immediate detection. (Tool: SHA-256 Hashes & Digital Signatures)
3. Availability: Ensuring that authorized users can access systems whenever needed. (Tool: Load Balancers, Cloud Redundancy, DDoS Defense)

---

Symmetric vs. Asymmetric Encryption

1. Symmetric Encryption (Shared Secret)

• Mechanism: One key locks the data, and the same key unlocks it.
• Algorithm: Advanced Encryption Standard (AES-128, AES-256).
• Advantage: Lightning-fast. Can encrypt gigabytes of video or database tables per second with minimal CPU usage.
• The Dilemma: How do you securely share the secret key with someone on the other side of the planet without an eavesdropper intercepting it?

2. Asymmetric Encryption (Public-Key Cryptography)

Invented by Diffie, Hellman, Rivest, Shamir, and Adleman (RSA) in the late 1970s. - Mechanism: Uses a Key Pair: - Public Key: Published openly to the world. Anyone can use it to encrypt a message for you. - Private Key: Guarded secretly on your device. Only your private key can decrypt the message!

Sender (Amina)                                    Recipient (Chinedu)
Plaintext: "Exam Scores"                          Possesses:
       │                                          - Public Key (Shared with Amina)
       ▼                                          - Private Key (Kept strictly secret)
[ Encrypt with Chinedu's PUBLIC Key ]
       │
       ▼ (Encrypted Ciphertext traveling across public internet)
0x8F9C1A0D... ─────────────────────────────────>  [ Decrypt with Chinedu's PRIVATE Key ]
                                                                 │
                                                                 ▼
                                                          Plaintext: "Exam Scores"

Modern Best Practice: Hybrid Cryptography! The internet uses Asymmetric RSA/ECC for 1 second to securely exchange a temporary AES key, then switches to fast Symmetric AES-256 for the rest of the session (this is how HTTPS / TLS works).

---

Cryptographic Hash Functions & The Avalanche Effect

A cryptographic hash function is a one-way mathematical street: - You can turn any text into a hash: SHA-256("Nigeria") $\rightarrow$ 64-character hex. - It is mathematically impossible to reverse the hash back into the original word!

Properties of Secure Hashes:

1. Deterministic: The exact same input always produces the exact same hash.
2. Fixed Length: Whether hashing 1 letter or an entire encyclopedia, SHA-256 always outputs exactly 256 bits (64 hex characters).
3. Collision Resistant: It is practically impossible to find two different inputs that produce the same hash.
4. Avalanche Effect: Changing a single character completely alters the hash!

---

Practical Activity: Cryptographic Hash and Digital Signature Lab in Python

Let us write a Python script demonstrating SHA-256 hashing, the avalanche effect, and basic digital message authentication.

Step 1: Create crypto_lab.py

import hashlib
import hmac

def generate_sha256(text):
    return hashlib.sha256(text.encode("utf-8")).hexdigest()

print("=== 1. SHA-256 HASH DETERMINISM AND AVALANCHE EFFECT ===")
msg1 = "Transfer ₦50,000 to Amina"
msg2 = "Transfer ₦50,000 to Amina." # Notice single added period '.'

hash1 = generate_sha256(msg1)
hash2 = generate_sha256(msg2)

print(f"Message 1: '{msg1}'")
print(f"SHA-256:   {hash1}")
print(f"\nMessage 2: '{msg2}'")
print(f"SHA-256:   {hash2}")

# Calculate percentage of hex characters changed
differences = sum(1 for a, b in zip(hash1, hash2) if a != b)
diff_pct = (differences / len(hash1)) * 100
print(f"\nAvalanche Metric: Adding a single '.' changed {differences} of 64 characters ({diff_pct:.1f}% change)!")

print("\n=== 2. MESSAGE INTEGRITY VERIFICATION (HMAC SIGNATURE) ===")
# Secret key shared between Bank Server and ATM
SHARED_SECRET_KEY = b"KinspireBankSecureKey2026"

def sign_transaction(payload, secret_key):
    return hmac.new(secret_key, payload.encode("utf-8"), hashlib.sha256).hexdigest()

def verify_transaction(payload, signature, secret_key):
    expected_sig = sign_transaction(payload, secret_key)
    return hmac.compare_digest(signature, expected_sig)

original_payload = "TXN_ID=9081;AMOUNT=25000;SRC=ACC101;DST=ACC202"
valid_signature = sign_transaction(original_payload, SHARED_SECRET_KEY)

print(f"Original Payload:   {original_payload}")
print(f"Cryptographic HMAC: {valid_signature[:32]}... (Truncated)")

# Test 1: Verify untouched message
is_valid = verify_transaction(original_payload, valid_signature, SHARED_SECRET_KEY)
print(f"Verification 1 (Legitimate): Authenticity Validated = {is_valid}")

# Test 2: Attacker intercepts and modifies amount from ₦25,000 to ₦95,000!
tampered_payload = "TXN_ID=9081;AMOUNT=95000;SRC=ACC101;DST=ACC202"
tamper_detected = verify_transaction(tampered_payload, valid_signature, SHARED_SECRET_KEY)
print(f"Verification 2 (Tampered):   Authenticity Validated = {tamper_detected}")
if not tamper_detected:
    print("ALERT: Digital signature rejected! Data tampering caught instantaneously.")

Step 2: Run the Script

python crypto_lab.py

---

Expected Results and Model Output

When you run crypto_lab.py, your terminal will display:

=== 1. SHA-256 HASH DETERMINISM AND AVALANCHE EFFECT ===
Message 1: 'Transfer ₦50,000 to Amina'
SHA-256:   d2f3422002f2b380dc99a9a5fef3737cb71ef4e5cfd4ebf075d6910e53a29910

Message 2: 'Transfer ₦50,000 to Amina.'
SHA-256:   c416c141d06e232cb9faeb398d57811be07c81d39226501fe1f99c1e7a57a4e6

Avalanche Metric: Adding a single '.' changed 60 of 64 characters (93.8% change)!

=== 2. MESSAGE INTEGRITY VERIFICATION (HMAC SIGNATURE) ===
Original Payload:   TXN_ID=9081;AMOUNT=25000;SRC=ACC101;DST=ACC202
Cryptographic HMAC: f8ffbfaaa0faaa387eb723ff4dd454df... (Truncated)
Verification 1 (Legitimate): Authenticity Validated = True
Verification 2 (Tampered):   Authenticity Validated = False
ALERT: Digital signature rejected! Data tampering caught instantaneously.

---

Common Mistakes to Avoid

1. Attempting to "Decrypt" a SHA-256 Hash: Hashes are one-way irreversible digests. You cannot reverse a hash back to its input text.
2. Sharing the Private Key: A public key is meant to be shared with the entire world. A private key must never leave the server or hardware security module (HSM).
3. Assuming Encryption Alone Guarantees Integrity: An encrypted message can still be tampered with or replaced by an attacker in transit. Modern cryptography uses Authenticated Encryption (such as AES-GCM) that guarantees both Confidentiality and Integrity simultaneously.

---

Notebook Summary

• The CIA Triad structures cybersecurity: Confidentiality, Integrity, and Availability.
• Symmetric Encryption (AES-256) uses a single shared secret key; it is fast and used for bulk data.
• Asymmetric Encryption (RSA) uses a Public Key to encrypt and a Private Key to decrypt, solving the key-exchange problem.
• Cryptographic Hashes (SHA-256) are one-way digests exhibiting the Avalanche Effect, verifying data integrity.
• Digital Signatures combine hashing with private-key signing to provide proof of origin and non-repudiation.

---

Optional Extension Challenge

Research the concept of Quantum Computing Threat to RSA. Why will Shor's Algorithm running on future quantum computers break 2048-bit RSA encryption, and what is Post-Quantum Cryptography (PQC)?

Check your understanding

What is the primary difference between Symmetric Key Ciphers (like AES) and Asymmetric Key Ciphers (like RSA)?

• Symmetric encryption uses the same single secret key for both encryption and decryption; Asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt
• Symmetric encryption is only for paper messages
• Asymmetric encryption requires no keys
• Symmetric encryption can only run on Linux servers

Which pillar of the CIA Triad is protected when a server uses SHA-256 cryptographic hashes to verify that a downloaded software installer has not been modified by malware?

• Integrity
• Confidentiality
• Availability
• Non-repudiation

In a Public Key Infrastructure (PKI), who possesses and has access to the user's Private Key?

• Exclusively the key owner; the private key must NEVER be shared, transmitted across networks, or disclosed to anyone
• The Internet Service Provider
• The general public
• Every web browser visiting the site

What is the 'Avalanche Effect' in cryptographic hash function engineering?

• Changing even a single bit in the input data causes a massive, unpredictable change in more than 50% of the output hash digest bits
• Computers overheating during encryption
• Data packets dropping during winter storms
• Keys expiring after 30 days

Check answer Try again Feedback appears after you check your answer.