If you used an electronic system today, you almost certainly depended on a cryptographic protocol to keep you out of harm’s way. Your access might have been a credit card transaction, a purchase at Amazon.com, or even just a mobile phone call. Or it could have been any one of a hundred other types of digital activity that depends in some way on cryptography.

Cryptography (literally, “hidden writing”) isn’t a new science. It dates back almost as far as the written word. Through most of that history it wasn’t exactly a science at all; the history of designing and breaking ciphers could be best described as a rare and underappreciated art form.

All of this changed somewhere between World War II and the disco era. With the advent of the digital computer and the communications network, cryptography was forced, awkwardly, into becoming a science.  But as we’ll see in these posts, successfully using cryptography is still very much an art.

Getting the message

Historically, if you wanted to send a confidential message — military orders during a war, let’s say — your best bet was to keep the message out of enemy hands. If you couldn’t do that, you only hope was that your enemy wouldn’t be able to make sense of what he had.

To make this work in practice, both you and your intended receipient needed to share some kind of understanding (or “key”) that would allow your recipient to decode the intended meaning. Furthermore, you needed to be reasonably sure that your enemy wouldn’t share that understanding. More has been written about this problem than is worth talking about here. Suffice it to say that it wasn’t the easiest problem, but it was a tractable one.

Fast forward to today. Instead of a soldier passing through enemy territory we have messages traveling over wired and wireless networks, in full view of eavesdroppers with sophisticated equipment. To make matters more complicated, we want to communicate with parties with whom we don’t share a prior relationship; for example, a website we’ve never visited before.  Even more interestingly, we may not fully trust the recipient of the message.

And as the icing on the cake, we’re doing this on the most insecure device ever invented: the modern general purpose computer. Even with the best modern cryptographic algorithms, building secure systems is a problem we’ve barely begun to solve. If you don’t believe this, all you need to do is take a glance through the list of successful breaks we’ve seen over the past few years!

So what’s this blog about?

This blog isn’t about the science of cryptography, or the strides that cryptographers have made over the past decades. We’ll mention those, since they’re important to the matter at hand.  But mostly we’re going to talk about failure. The kind of failures that occur on a routine basis when people actually try to implement modern cryptosystems.

Those failures are many and varied. To understand them, we’ll discuss some of the basic concepts of encryption and authentication. We’ll move on to discuss software vulnerabilities and physical security, including how side-channel attacks affect cryptographic implementations. In every case we’ll give real-world examples of systems that succeeded or failed because of a specific issue.

The content of this blog is an attempt to compress a semester-long course that I give from time to time, into something that stands on its own and doesn’t require textbook lengths. It isn’t intended to be a primary source on cryptographic algorithms — for that there are many other references, which I’ll provide as time goes by.  Instead, the purpose of this blog is to provide, via examples, an understanding of all the ways that cryptographic systems can fail.  At very least you’ll develop an appreciation of how hard it is to develop these systems yourself.