Network Security and Cryptography

Learning Objectives

• Define network security and explain the goals it tries to achieve (confidentiality, integrity, availability, authentication, non-repudiation)
• Distinguish symmetric from asymmetric cryptography and explain why real systems use both together
• Explain how hash functions differ from encryption and why they can't be "decrypted"
• Trace how TLS combines asymmetric and symmetric cryptography to secure a web connection
• Identify common misconceptions about encryption strength, hashing, and "unbreakable" security
• Compare block ciphers and stream ciphers and know when each is appropriate

Quick Answer

Network security is the set of practices and technologies that protect data and systems from unauthorized access, tampering, and disruption while they travel across or sit on a network. Cryptography is the mathematical toolkit that makes most of that protection possible: it scrambles data (encryption) so only authorized parties can read it, and it fingerprints data (hashing) so tampering can be detected. Modern systems rarely rely on one technique alone — a website's HTTPS connection, for example, uses asymmetric cryptography just long enough to safely exchange a symmetric key, then switches to fast symmetric encryption for the actual data. Understanding this combination is the key to understanding almost every secure system you use daily.

Network Security: Goals Before Tools

Definition. Network security is the practice of protecting the confidentiality, integrity, and availability of data and systems as they move across or reside on a network, against threats like eavesdropping, tampering, impersonation, and denial of service.

Explanation. It's tempting to jump straight to "encryption" when you hear network security, but encryption is only one tool serving several distinct goals. Security professionals typically organize these goals as:

• Confidentiality — only authorized parties can read the data (achieved via encryption).
• Integrity — the data hasn't been altered in transit (achieved via hashing and message authentication codes).
• Authentication — you can verify who you're actually talking to (achieved via digital certificates and signatures).
• Non-repudiation — a sender can't later deny having sent something (achieved via digital signatures).
• Availability — the system stays usable even under attack (achieved via redundancy, rate-limiting, and DDoS mitigation, not cryptography).

Example. When your browser shows a padlock icon on a banking site, several of these goals are working together: TLS encryption gives confidentiality, TLS's message authentication gives integrity, and the site's certificate gives authentication (proof you're talking to your bank, not an impostor).

Real-world example. In 2011, attackers compromised the certificate authority DigiNotar and issued fraudulent certificates for domains including google.com. Confidentiality (encryption) was technically intact — but authentication was broken, so attackers could impersonate Google to unsuspecting users. This is a textbook example of why encryption alone is not "security."

Why it matters. Treating "security" as synonymous with "encryption" leads to systems that encrypt data perfectly while still being trivially impersonated, tampered with, or taken offline. Real security design has to address all five goals, not just confidentiality.

Common misunderstanding. Students often assume that if traffic is encrypted, it's automatically safe from all attacks. Encryption alone says nothing about who you're actually connected to (authentication) or whether the service will stay online (availability) — a perfectly encrypted connection to an attacker impersonating your bank is still a disaster.

Symmetric and Asymmetric Cryptography

Definition. Symmetric cryptography uses one shared secret key for both encryption and decryption. Asymmetric (public-key) cryptography uses a mathematically linked key pair — a public key that can be shared openly and a private key that must stay secret.

Explanation. With symmetric ciphers like AES, both parties must already possess the same secret key — which creates a chicken-and-egg problem: how do you securely share that key over an insecure network in the first place? Asymmetric cryptography solves exactly this problem. Anyone can encrypt a message using your public key, but only your private key can decrypt it, so two parties who have never met can still establish a shared secret safely. The catch is that asymmetric algorithms (like RSA) are computationally far more expensive than symmetric ones — often 100 to 1,000 times slower for the same amount of data.

Example. Suppose Alice wants to send Bob a confidential file. Encrypting the entire file with Bob's public key (RSA) would be correct but painfully slow for anything larger than a few kilobytes. Instead, Alice generates a random symmetric key (an AES key), encrypts the file with that fast symmetric key, and encrypts only the small AES key with Bob's public key. Bob decrypts the tiny AES key with his private key, then uses that key to decrypt the large file quickly. This hybrid approach is exactly what TLS does.

Real-world example. Every HTTPS connection performs this hybrid handshake: the browser and server use asymmetric cryptography briefly to agree on a shared symmetric session key, then use fast symmetric encryption (typically AES) for the actual page data. Pure asymmetric encryption for gigabytes of streaming video would be far too slow.

Why it matters. This hybrid model is the reason the modern internet is both fast and secure — it gets the key-exchange convenience of asymmetric cryptography without paying its performance cost for bulk data.

Common misunderstanding. Students often think asymmetric cryptography is "more secure" than symmetric cryptography because it uses two keys. Security strength depends on key length and algorithm design, not the number of keys — a 128-bit AES key is considered comparably strong to a 3072-bit RSA key. Asymmetric crypto is chosen for key exchange and signatures, not because it's inherently "stronger."

Hash Functions and Digital Signatures

Definition. A hash function takes input data of any size and deterministically produces a fixed-size output (a digest). Unlike encryption, hashing is one-way — there is no key to "decrypt" a hash back into its original input.

Explanation. A good cryptographic hash function (like SHA-256) has three properties: the same input always produces the same output, a tiny change in input produces a completely different output (the avalanche effect), and it's computationally infeasible to find two different inputs that produce the same output (collision resistance). This makes hashing perfect for verifying that data hasn't changed — you compare hashes, not the data itself.

Hashing underpins digital signatures: to sign a message, you hash it (producing a short digest) and then encrypt that digest with your private key. Anyone with your public key can decrypt the digest, hash the message themselves, and check the two match — proving both that you signed it (authentication) and that it wasn't altered (integrity).

Example. When you download a Linux ISO, the distribution's website often publishes a SHA-256 checksum alongside it. After downloading, you hash the file yourself and compare it to the published value. If even a single bit was corrupted or tampered with during download, the hashes won't match — you'll know instantly, without needing to inspect the entire file.

Real-world example. Password storage relies on hashing, never encryption. When you log in, the site hashes the password you typed and compares it to the stored hash — it never stores or decrypts your actual password. This is why a data breach of hashed passwords doesn't hand attackers your plaintext password directly (though weak or unsalted hashes can still be cracked).

Why it matters. Confusing hashing with encryption is one of the most consequential mistakes in security engineering — storing passwords with reversible encryption instead of one-way hashing has caused real breaches to expose plaintext passwords directly.

Common misunderstanding. Students frequently ask "how do you decrypt a hash?" — you don't, and you can't, by design. If you need to recover the original data, you need encryption (reversible); if you only need to verify data integrity or check a password, you need hashing (one-way). MD5 and SHA-1, once popular hash functions, are now considered broken because researchers found ways to engineer collisions — a reminder that hash function security is not permanent.

Block Ciphers, Stream Ciphers, and Putting It Together

Definition. A block cipher encrypts data in fixed-size chunks (blocks), typically 128 bits, while a stream cipher encrypts data one bit or byte at a time as a continuous stream.

Explanation. Block ciphers like AES need a mode of operation (e.g., CBC or GCM) to handle data that isn't an exact multiple of the block size and to avoid identical plaintext blocks producing identical ciphertext blocks. Stream ciphers avoid this complexity by generating a pseudorandom keystream and XOR-ing it directly with the plaintext, which suits real-time applications where data arrives continuously and can't wait for a full block to accumulate.

TLS ties everything covered in this page together in one real protocol: during the handshake, the client and server use asymmetric cryptography (often via certificates) to authenticate the server and agree on a shared symmetric key; for the rest of the session, that symmetric key (often via AES in GCM mode, which is a block cipher mode) encrypts data and simultaneously provides integrity checking, so a single mechanism does both jobs.

Example. AES-GCM, used by most modern HTTPS connections, is a block cipher mode that produces both ciphertext and an authentication tag in one pass — meaning it detects if even one bit of the encrypted traffic was tampered with in transit, without a separate integrity-checking step.

Real-world example. VPNs commonly use AES in CBC or GCM mode to encrypt tunneled traffic between your device and a VPN server, effectively wrapping your entire internet connection in a private, authenticated channel even when the underlying network (e.g., public Wi-Fi) is untrusted.

Why it matters. Choosing the right cipher and mode isn't a minor implementation detail — using a weak mode (like ECB, which encrypts identical blocks identically) can leak patterns in the data even though the cipher itself is strong, which is why security audits scrutinize modes of operation as closely as the algorithm choice.

Common misunderstanding. Some students think "AES" alone tells you a system is secure. AES is an algorithm; how it's used (key length, mode of operation, key management, protocol design) determines actual security. A strong cipher used with a weak mode, a reused key, or leaked private keys is not secure regardless of the algorithm's reputation.

Key Terms

Term	Definition
Confidentiality	The property that only authorized parties can read given data; achieved through encryption.
Integrity	The property that data has not been altered in transit or storage; verified through hashing/MACs.
Authentication	Verifying the identity of a communicating party, often via digital certificates.
Non-repudiation	A guarantee that a sender cannot later deny having sent a message; achieved via digital signatures.
Symmetric cryptography	Encryption using a single shared secret key for both encryption and decryption (e.g., AES).
Asymmetric cryptography	Encryption using a linked public/private key pair; public key encrypts, private key decrypts (e.g., RSA).
Hash function	A one-way function producing a fixed-size digest from input of any size; used for integrity, not confidentiality.
Digital signature	A hash of a message encrypted with the sender's private key, proving authenticity and integrity.
Block cipher	A cipher that encrypts data in fixed-size chunks (e.g., AES operates on 128-bit blocks).
Stream cipher	A cipher that encrypts data continuously, bit by bit or byte by byte, by XOR-ing with a keystream.
TLS	Transport Layer Security; the protocol securing most HTTPS traffic using a hybrid of asymmetric and symmetric cryptography.
Certificate authority (CA)	A trusted entity that issues digital certificates binding public keys to verified identities.

Common Mistakes

Misconception	Why it's wrong	Correct understanding
"Encrypted traffic is automatically safe."	Encryption only provides confidentiality; it says nothing about who you're actually connected to or whether the service stays available.	Security requires confidentiality, integrity, authentication, and availability together — encryption alone addresses only one of these.
"Hashing is just a weaker form of encryption."	Hashing is one-way by design; there is no key or process to recover the original input from a hash.	Encryption is reversible (with the right key); hashing is deliberately irreversible and used for verification, not to hide-and-recover data.
"Asymmetric cryptography is always better because it has two keys."	Strength depends on algorithm and key length, not key count; asymmetric crypto is also far slower for bulk data.	Real systems use asymmetric cryptography for key exchange and signatures, then switch to symmetric cryptography for fast bulk encryption.

Comparison and Connections

Concept	Key/Mechanism	Speed	Typical Use	Reversible?
Symmetric encryption (AES)	One shared secret key	Fast	Bulk data encryption (files, TLS session data)	Yes, with the key
Asymmetric encryption (RSA/ECC)	Public/private key pair	Slow	Key exchange, digital signatures	Yes, with the private key
Hash function (SHA-256)	No key	Very fast	Integrity checks, password storage, digital signatures	No — one-way by design
Block cipher (AES)	Fixed-size blocks + mode	Fast	File/disk encryption, TLS bulk data	Yes, with key and correct mode
Stream cipher	Continuous keystream	Fast, low latency	Real-time voice/video encryption	Yes, with key/keystream

Practice Questions

Recall

1. What are the five core goals of network security? Answer guidance: Confidentiality, integrity, authentication, non-repudiation, and availability.
2. What is the fundamental difference between a hash function and an encryption algorithm? Answer guidance: Encryption is reversible with the correct key; hashing is a one-way function with no way to recover the original input.

Understanding

3. Explain why TLS uses both asymmetric and symmetric cryptography instead of just one. Answer guidance: Asymmetric cryptography solves the key-exchange problem safely but is too slow for bulk data; symmetric cryptography is fast but requires a securely shared key first. TLS uses asymmetric crypto briefly to exchange a symmetric session key, then symmetric crypto for the actual data.
4. Why can't you "decrypt" a password hash to recover the original password? Answer guidance: Hash functions are one-way by mathematical design — there is no inverse operation. Verification works by hashing the entered password and comparing digests, not by reversing a stored hash.

Application

5. A company wants to let a remote employee securely access internal file servers over the public internet. What technology would you recommend and why? Answer guidance: A VPN, since it uses encryption (commonly AES) to create an authenticated, encrypted tunnel over the untrusted public network, protecting confidentiality and integrity of the traffic.
6. A developer stores user passwords using a reversible encryption algorithm instead of a hash function. Why is this a security risk, and what changes if the database is breached? Answer guidance: Reversible encryption means anyone who obtains the encryption key (or breaks the algorithm) can recover all plaintext passwords at once; with proper salted hashing, an attacker at most gains hashes that must be cracked individually and slowly, greatly limiting damage.

Analysis

7. Compare block ciphers and stream ciphers in terms of how they process data and where each is best suited. Answer guidance: Block ciphers encrypt fixed-size chunks and need a mode of operation to handle arbitrary-length data and prevent pattern leakage; stream ciphers encrypt continuously via XOR with a keystream, suiting real-time applications where data arrives incrementally and low latency matters.
8. Evaluate the claim: "Since AES is a proven, unbroken algorithm, any system using AES is secure." What's missing from this reasoning? Answer guidance: Algorithm strength is necessary but not sufficient — security also depends on key length, mode of operation, key management/storage, protocol design, and implementation correctness. A strong algorithm used poorly (weak mode, leaked keys, poor randomness) is not secure.

FAQ

Q: Is HTTPS the same thing as TLS? Not exactly. HTTPS is HTTP running over a TLS-encrypted connection. TLS is the general-purpose security protocol; HTTPS is just one application (secure web browsing) that uses it. Email, VPNs, and other protocols use TLS too.

Q: Why do we still use symmetric encryption if asymmetric encryption exists? Because asymmetric encryption is far slower for large amounts of data. Symmetric encryption is what actually protects the bulk of your data in nearly every secure system — asymmetric cryptography's job is mainly to safely establish that symmetric key in the first place.

Q: If MD5 and SHA-1 are "broken," why are they still seen sometimes? They're broken for security purposes (an attacker can engineer hash collisions), but they're still used in non-security contexts like checking for accidental file corruption, where an adversary isn't deliberately trying to create a collision.

Q: What actually happens if a certificate authority gets compromised? Attackers could get fraudulent certificates issued for domains they don't own, letting them impersonate legitimate sites even over an "encrypted" connection — which is why browsers maintain strict lists of trusted CAs and can revoke trust in a compromised one.

Q: Does a VPN make me completely anonymous and secure? No. A VPN encrypts traffic between you and the VPN provider and can hide your IP from the sites you visit, but the VPN provider itself can see your traffic, and it does nothing to protect you from malware, phishing, or a compromised endpoint device.

Quick Revision

• Network security goals: confidentiality, integrity, authentication, non-repudiation, availability — encryption alone only covers confidentiality.
• Symmetric cryptography: one shared key, fast (AES); asymmetric cryptography: public/private key pair, slower but solves key exchange (RSA, ECC).
• Real systems (TLS, VPNs) use a hybrid model — asymmetric crypto to exchange a key, symmetric crypto for bulk data.
• Hash functions are one-way; they verify integrity and store passwords safely, but cannot be "decrypted."
• Digital signatures = hash of a message encrypted with the sender's private key; proves authenticity and integrity.
• Block ciphers (AES) encrypt fixed-size chunks and need a mode of operation; stream ciphers encrypt continuously, suited to real-time data.
• SHA-256 is currently considered secure; MD5 and SHA-1 are broken for security purposes due to found collisions.
• AES-GCM combines encryption and integrity checking (authentication tag) in a single operation.
• A certificate authority (CA) binds public keys to verified identities — its compromise undermines authentication even if encryption itself works.
• Algorithm strength alone doesn't guarantee security — key length, mode of operation, and key management all matter.

Related Topics

Prerequisites

• Introduction to Computer Networks
• Network Layer and Routing Protocols
• Transport Layer Protocols

Related Topics

• Wireless Networks and Mobile Communication
• Network Management and Troubleshooting
• Operating Systems Security Concepts

Next Topics

• Wireless Networks and Mobile Communication
• Cloud Computing Security
• Internet of Things (IoT) Security