Encryption and decryption overview and. Net Support for encryption and decryption (1)

Encryption and decryption overview and. Net Support for encryption and decryption

 

Introduction

 

In some important application scenarios, data transmission over the network needs to be encrypted to ensure security. This article briefly introduces some concepts of encryption and decryption, as well as related digital signatures and certificates, and finally introduces how to perform symmetric encryption and decryption on data in. net.

 

Encryption and decryption

 

When it comes to encryption, MD5 is probably the most familiar one. I remember an ASP Forum program I studied when I first started to use web programming a few years ago, its user password is encrypted using MD5. MD5 is actually a hash operation, or it can be called one-way encryption, that is, the plaintext (original data) cannot be exported Based on the ciphertext (encrypted data ). What we should note below is that data can be decrypted and restored after encryption. For objects to be encrypted, some are called messages, some are called data, and some are called information. To avoid confusion, I will refer to themMessage. So what is encryption? Encryption creates a secure communication mode by encoding messages so that only you and the expected receiver can understand them.

So how can we call it security? Messages are transmitted securely between the recipient and the sender. the following three key points must be met:

1. the sender of the message can determine that only the expected receiver can decrypt the message (the third party cannot obtain the message, but the third party cannot decrypt the message ).

2. The message receiver can determine who sent the message (the message receiver can determine the sender of the message ).

3. the receiver of the message can determine that the message has not been tampered with on the way (the message integrity must be confirmed ).

Encryption is usually divided into two methods: symmetric encryption and asymmetric encryption. Next we will first look at symmetric encryption.

 

Symmetric encryption

 

The idea of symmetric encryption is very simple.KeyBefore the message is sent, use the key to encrypt the message. After the recipient receives the message, useSameKey. The process of generating encrypted messages (ciphertext) based on the key.Encryption AlgorithmTo complete,Encryption algorithms are usually public. The process is as follows:

1. The sender uses the key to encrypt the message.

2. The recipient decrypts the message using the same key.

You can use the following figure to represent it:

Symmetric encryption has two problems:

1. Although the key can be used to ensure secure transmission of messages, how can we ensure secure transmission of keys? Because the sender and receiver always have an initial communication to transmit the key, how can we ensure the security at this time?

2. Although the recipient can decrypt the message based on the key, the message may be sent by a third party (illegally obtaining the key) due to the above problem, and the recipient cannot identify the message.

To solve the above two problems, we need to introduce asymmetric encryption.

 

Asymmetric encryption

 

Asymmetric encryptionReceiver and senderBoth of them hold two keys. One is open to the outside world and is calledPublic Key, One is self-managed, calledPrivate Key. The asymmetric encryption rule isMessages encrypted by a's public key can only be decrypted by a's private key. Messages encrypted by a's private key can only be decrypted by a's public key.In this case, we can conclude that the receiver and sender have two public keys and two private keys. Let's take a look at two simple methods, both of which use only two keys.

The first mode only uses the public key and private key of the receiver, which is called the encryption mode.

 

Encryption Mode

 

In encryption modeReceiverPublish the public key and hold the private key. For example, if the sender wants to send the message "Hello, Jimmy" to the receiver, the procedure is as follows:

1. The sender uses the receiver's public key to encrypt the message and then sends it.

2. the receiver uses its own private key to decrypt the message.

You can use the following figure to describe:

 

In this mode, if a third party intercepts the message sent by the sender because the sender does not have the private key of the receiver, the message is meaningless to him. It can be seen that it can satisfy the key points of secure message transfer proposed at the beginning of this article:The sender of the message can determine that only the expected receiver can decrypt the message (the third party cannot obtain the message, but the third party cannot decrypt the message).

In addition, because the public key of the receiver is public, anyone can use this public key to encrypt the message and send it to the receiver. The receiver cannot identify the message, you cannot know who sent the message. Therefore, it does not meet the following key points of secure message transmission:The receiver of the message can determine who sent the message (the receiver of the message can determine the sender of the message ).

This problem can be solved in the following Authentication mode.

 

Authentication Mode

 

In Authentication modeSenderPublish the public key and hold the private key. For example, if the sender wants to send the message "Welcome to tracefact.net" to the receiver, the procedure is as follows:

1. The sender uses his/her own private key to encrypt the message and then sends it.

2. The recipient decrypts the message using the sender's public key.

It can be expressed in the following figure:

 

In this mode, if the sender is called a Ken and the receiver is called Matthew, because Matthew can only decrypt the message using the public key of the Ken, molly, Sandy, or any other person's public key cannot be used to decrypt the message, so he must be able to determine that the message was sent by the Ken. Therefore, this mode satisfies the two key points of secure message transmission.

At the same time, because the public key of the Ken is public, any third party that intercepts the message can use the public key of the Ken to decrypt the message. In other words, the message isInsecure. Therefore, in contrast to the encryption mode, it cannot meet the key aspect of secure message transmission proposed above.

No matter whether the encryption mode or authentication mode is used, key aspect 3 in encryption and decryption is not solved: the receiver must be able to confirm that the message has not been changed. To solve this problem, a digital signature is introduced.

 

Digital Signature

 

Basic implementation

 

The digital signature is actually the Authentication Mode in the above asymmetric encryption mode, but a little improvement is made, and the hash algorithm is added. The hash algorithm that everyone is familiar with may be MD5, which is used in many open source forums. Hash algorithms have three features: one is irreversible, and the result cannot be used to calculate the original data; the other is that the original data is slightly changed, the hash value changes greatly. Third, no matter how large or small the data is, a fixed-length hash value is always generated (usually 32-bit and 64-bit ). The generated hash value is usually called the messageSummary(Digest ).

So how can we ensure data integrity by introducing hash functions? That is, the receiver can confirm that the message is sent by the sender, but has not been modified in the middle. The specific process is as follows:

1. The sender performs a hash operation on the messages to be transmitted to obtain the message digest.

2. the sender uses his/her own private key to encrypt the digest and send the message and the encrypted digest to the receiver.

3. the receiver decrypts the message and message digest using the sender's public key (the sender is confirmed ).

4. The receiver hashes the received messages to obtain a message digest.

5. The receiver compares the message digest obtained in the previous step with the message digest sent by the sender. If they are the same, the message has not been modified. If they are different, the message has been tampered.

This process can be expressed in the following figure:

 

We can see that by introducing the hash algorithm, the digital signature enhances the asymmetric encryption authentication mode and ensures message integrity. Note that the above asymmetric encryption algorithm,Only the message digest is encrypted, but the message itself is not encrypted.. Asymmetric encryption is a very time-consuming operation. Because only the message digest is encrypted, the calculation workload is greatly reduced, so it can significantly improve the execution speed of the program. At the same time, it still does not ensure that the message is not intercepted by a third party, not only that, because the message is transmitted in plaintext, the third party can directly view the message without the sender's public key.

To solve this problem, you only need to combine the asymmetric encryption authentication mode, encryption mode, and message digest. This is the following advanced mode.

 

Advanced implementation

 

Since this process is a little more complex than above, we will divide it into two parts: the sender and the receiver. First lookSenderSteps:

1. Hash the message to obtain the message digest.

2. Use your own private key to encrypt the message digest (Authentication Mode: ensures that the recipient can confirm himself ).

3. Use the receiver's public key to encrypt the message (encryption mode: ensures that the message can only be decrypted by the expected receiver ).

4. Send messages and message summaries.

Next, let's take a look at the steps executed by the receiver:

1. Use the sender's public key to decrypt the message digest (confirm who sent the message ).

2. Use your own private key to decrypt the message (the actual information is securely obtained ).

3. Hash the message to obtain the message digest.

4. Compare the message digest obtained in the previous step with the message digest decrypted in the first step (check whether the message is tampered ).

As you can see, in the above method, all four keys of the receiver and sender are used, and the message digest is used together, so that all the three conditions for safe transmission mentioned above are met. So is this method the best? No, as we have already said, asymmetric encryption is a very time-consuming operation, so this solution is very inefficient. In fact, we can solve the key transfer problem in symmetric encryption through it. If you forget it, you can go to the front and take a look. That is to say, we can use the advanced implementation method here to transmit the key in symmetric encryption. For actual data transmission afterwards, the symmetric encryption method is used, because it is safe now.

 

Certificate Mechanism

 

A concept related to digital signature is the certificate mechanism. What is a certificate used? In the above models, we have always used the assumption that the public key held by the receiver or sender and the other party is always correct (indeed published by the other party ). In fact, unless the other party hand over the public key to us, if no action is taken, the two parties may be tampered with when passing the public key in the network. How can this problem be solved? In this case, the certificate mechanism is required: You can introduceFairWhen a third party wants to publish a public key, it submits its own identity information and public key to the third party. The third party confirms its identity. If no problem exists, then, the Information and Public Key are packagedCertificate (certificate). This fair third party is often saidCertificate Authority). When we need to obtain the public key, we only need to obtain its certificate, and then extract the public key from it.