UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 13.10 Free with a free account
The Mathematical Building Blocks Behind Symmetric and Asymmetric Encryption Methods
Ethics in Technology · Chapter 13: Digital Espionage, Online Threats, and the Science of EncryptionSection 13.10 · lesson 87 of 11616 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: The Current Gold Standard in Encryption — How AES Protects Data Worldwide →← What Encryption Actually Does to Your DataNext lesson: The Current Gold Standard in Encryption — How AES Protects Data Worldwide →
In this lesson
Symmetric transformations, public-key mathematics, and hybrid protection.
- Explain substitution, permutation, confusion, diffusion, and cipher rounds.
- Distinguish block ciphers, stream ciphers, and modes of operation.
- Follow modular arithmetic, the RSA example, Diffie-Hellman, and ECC.
- Compare classical security strengths and explain hybrid systems.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (2,009 words). Read along, or search it.
Chapter 13
Encryption’s Building Blocks
Symmetric and public-key methods solve different parts of the problem of protecting digital information. This lesson explains their basic transformations and the mathematical relationships behind selected public-key methods. We will connect substitution and permutation with confusion, diffusion, and repeated cipher rounds. Then we will distinguish block ciphers, stream ciphers, and the modes used with blocks. A small R S A example lets us check encryption and decryption arithmetic directly. Diffie-Hellman demonstrates shared-secret agreement, and elliptic curves illustrate different key-size requirements for comparable strength. Finally, compare classical security levels and explain why hybrid systems combine the two families. The examples explain concepts; real protection also needs suitable algorithms, parameters, protocols, and implementation.
Substitution and Permutation
Replacing Values and Rearranging Positions Serve Different Roles
Symmetric encryption uses a shared secret key for the corresponding encryption and decryption operations. Substitution replaces an input chunk with another value, according to a rule such as a lookup table. An S-box is the substitution table used by some cipher designs, including A E S. The letter example, A becoming Q, illustrates replacement without claiming to describe a modern byte-level operation. Permutation rearranges positions while retaining the values, much like shuffling pieces into a different order. Rearrangement alone does not hide the values or spread one bit into multiple influenced bits. Diffusion arises through the combined operations, which spread input influence throughout the cipher’s output. Confusion makes the relationship between key information and output difficult to exploit through useful patterns. Claude Shannon described these goals in nineteen forty-nine. They remain helpful concepts for understanding cipher design. Repeated rounds combine transformations with key material, rather than relying on one visible substitution or shuffle. Good diffusion makes small input changes affect many output bits, without guaranteeing exactly half in every case.
AES as an Example
Defined Transformations Repeat with Derived Round Keys
A E S provides a concrete example, processing data in blocks of a hundred twenty-eight bits. Its byte substitution uses a defined nonlinear S-box, rather than an improvised letter replacement alphabet. Row shifting rearranges byte positions, and column mixing combines information within each column of the state. The round-key operation uses exclusive O R, usually called X O R, to combine key material. These round keys are derived from the cipher key; they are not independently delivered new secrets. The hundred twenty-eight-bit key version performs ten rounds. The hundred ninety-two-bit key version performs twelve rounds. The two hundred fifty-six-bit version performs fourteen rounds, with the same block size as the others. Its final round omits column mixing, so the introductory repeating-pattern picture is a simplified explanation. Using a table and a shuffle does not automatically create a strong or secure cipher. Not every modern symmetric cipher uses this particular network; other designs use different combinations of operations. Choose a sound, analyzed algorithm and implement its requirements correctly, rather than inventing transformations from the analogy.
Two Cipher Shapes
Block and Stream Ciphers Are Not Restricted to Different Media
A block cipher transforms fixed-size blocks, using the secret key and its defined algorithm. For example, A E S always operates on blocks of a hundred twenty-eight bits. A stream cipher generates key-dependent material that is combined with the message, commonly using exclusive O R. ChaCha twenty is a modern stream-cipher example. R C four is an obsolete, insecure example of that family. R C four is insecure for modern T L S protection and should not be selected. ChaCha twenty uses addition, rotation, and exclusive O R, instead of the A E S S-box design. Both families can support stored files and network traffic when used within suitable cryptographic constructions. Block-cipher modes can process arriving data; they do not always need the entire message first. The distinction concerns their operation, rather than requiring one family for files and another for live calls. Both need correct keys and the initialization or nonce handling required by the selected construction.
Modes of Operation
The Mode Determines How Blocks Protect a Larger Message
A mode of operation specifies how a block cipher is applied across a larger message. Electronic codebook, or E C B, encrypts each block independently under the same key. Identical plaintext blocks therefore produce identical ciphertext blocks, exposing repetition and potentially the structure of an image. Cipher block chaining, or C B C, combines each plaintext block with the preceding ciphertext before encryption. It begins with an initialization vector that must be unpredictable, and encryption proceeds through the chain. Decryption can parallelize its block-cipher calculations, even though encryption depends on the chain. Counter mode, or C T R, encrypts counter values and combines the results with the message. This supports independent or parallel processing, provided counter blocks are not reused under the same key. Galois counter mode, or G C M, adds an authentication tag to counter-based confidentiality protection. The receiver must verify the tag, and the scheme’s initialization-value uniqueness requirements are essential. C B C and counter mode alone do not supply the authentication needed to reject altered data. Their secure use requires an appropriate construction, rather than assuming ciphertext cannot be modified. Different modes reduce pattern leakage through specific rules, not a guarantee of mathematically unique output everywhere. Nonce handling, authentication checks, and implementation requirements are parts of security, alongside the block cipher itself.
Public-Key Mathematics
Modular Arithmetic Describes Wraparound, Not Security by Itself
Public-key methods use mathematically related public and private values, with operations determined by the scheme. Encryption, signature verification, and key agreement are different purposes; not every method supports every operation. Modular arithmetic provides a useful language for several classical public-key algorithms, including R S A. It retains the remainder after division by a chosen modulus, producing the familiar wraparound behavior. On a twelve-hour clock, adding nine hours to eight reaches seventeen. Wrapping around the clock takes that result back to five. This illustrates the arithmetic; wrapping around alone does not make a problem computationally difficult to reverse. A trapdoor idea combines an easy forward operation with secret information enabling the intended reversal. R S A uses two large primes and their product, together with appropriate modular exponents. Multiplying those primes is efficient, while factoring a suitably chosen large product is difficult for known classical methods. Factoring compromises the mathematical secret. Insecure encoding, implementation errors, or stolen keys can also defeat protection.
RSA Demonstration
Small Values Make the Forward and Reverse Calculations Checkable
The source’s toy R S A example starts with primes sixty-one and fifty-three. Multiplying them gives three thousand two hundred thirty-three, the modulus used in the subsequent calculations. The public exponent is seventeen, chosen to satisfy the required relationship with the prime-derived arithmetic. The private exponent is two thousand seven hundred fifty-three, derived using the primes and public exponent. Together, the modulus and public exponent form the public pair used in this demonstration. For encryption, take message value sixty-five and raise it to the seventeenth power, modulo the modulus. The result is two thousand seven hundred ninety, the ciphertext value in this small example. For reversal, raise that ciphertext to the private exponent and again reduce it modulo the modulus. This returns sixty-five, demonstrating how the paired exponents recover the original message value. The private exponent permits reversal. These small values provide no practical security against a knowledgeable observer. Real R S A uses large suitable keys and a secure encoding scheme around the underlying operation. The bare arithmetic here is not a complete secure encryption system or a recommended implementation recipe.
Diffie-Hellman Exchange
Public Values Travel; the Private Inputs Remain Local
Diffie-Hellman addresses agreement on a shared result, rather than directly encrypting the entire message. Both parties use suitable public starting values and each chooses a private input that remains local. The source’s small demonstration uses starting value five and modulus twenty-three, which are deliberately insecure. Alice’s private input is six; raising five to that power, modulo twenty-three, gives public value eight. Bob’s private input is fifteen; the corresponding calculation gives his public value of nineteen. They exchange those public values, without transmitting their private inputs or the eventual shared result. Alice combines nineteen with her private six through modular exponentiation, obtaining the result two. Bob combines eight with his private fifteen through the corresponding calculation, also obtaining two. The algebra makes the results agree, although the private inputs were chosen separately by the parties. With suitable parameters, a passive observer faces a difficult discrete-logarithm-related problem rather than reading the secret directly. An active impersonator can substitute public values unless the exchange is authenticated within a suitable protocol. The resulting secret material must then be used through the protocol’s appropriate key-derivation and protection procedures.
Elliptic Curve Cryptography
Comparable Classical Strength Can Use Shorter Key Parameters
Elliptic curve cryptography, commonly called E C C, uses operations on carefully selected curve points. Repeated point addition computes a public point using a private scalar and a starting point. The associated discrete logarithm problem asks which scalar connects the starting point with the public result. Suitable curves make that recovery difficult, under the classical attack models used in these comparisons. For comparable classical strength, elliptic curve parameters can be much shorter than R S A parameters. This can reduce resource demands for applications such as phones, smart cards, and other constrained devices. It does not mean every curve is suitable. Nor does every shorter key provide equivalent protection. Security strength reflects the best relevant attacks, rather than simply counting all full-length keys. For E C C, relevant mathematical attacks can outperform testing every full-length key. Use algorithm-specific strength estimates and suitable parameters, rather than comparing raw lengths across unrelated methods.
Key-Length Comparison
The Source’s Examples Compare Estimated Classical Work Factors
The comparison table describes approximate classical security strengths, not a universal set of recommended key selections. The historical eighty-bit row lists a thousand twenty-four-bit modulus and a hundred sixty-bit curve example. Eighty-bit strength is inadequate; keeping that historical comparison does not recommend it for new protection. At a hundred twelve-bit strength, the source lists two thousand forty-eight and two hundred twenty-four. At a hundred twenty-eight-bit strength, the modulus example is three thousand seventy-two bits. Its elliptic curve example is two hundred fifty-six bits. The symmetric-key example has a hundred twenty-eight bits. At a hundred ninety-two-bit strength, the examples are seven thousand six hundred eighty and three hundred eighty-four. At two hundred fifty-six-bit strength, the modulus example is fifteen thousand three hundred sixty bits. The corresponding curve example is five hundred twenty-one bits. The symmetric-key example has two hundred fifty-six bits. Finite-field Diffie-Hellman also needs appropriate subgroup sizes and other parameters, beyond the displayed modulus length. The eighty and hundred twelve symmetric entries compare search strengths; they are not additional A E S variants. These estimates concern classical attacks and do not establish protection against a future large-scale quantum computer.
Hybrid Systems
Establish Key Material, Then Protect the Bulk Data Efficiently
Hybrid systems combine the complementary strengths of public-key methods and efficient symmetric message protection. A suitable protocol first authenticates the intended participants and establishes the necessary shared key material. Public-key techniques can perform key agreement or key transport, depending on the construction being used. The endpoints then derive the symmetric traffic keys that protect the actual messages or file contents. Bulk symmetric processing is generally more efficient than repeatedly applying public-key operations to all the content. That makes the combination practical for online communication and other applications handling substantial amounts of data. Modern connections can use this pattern, but not every connection necessarily performs the same public-key exchange. A session key is not a one-time pad. It may protect more than one data block. The protocol still needs appropriate nonces, authentication, usage limits, and renewal rules throughout the session. Hybrid protection combines distinct jobs; it does not remove the responsibilities associated with either family.
Review and Apply
Connect the Transformation, the Hard Problem, and the Protocol
For the first review, explain substitution as replacing values and permutation as rearranging their positions. Connect the combined rounds with confusion and diffusion, remembering that rearrangement alone does not multiply input influence. For the second review, explain why electronic codebook exposes repetition through identical ciphertext for identical blocks. For the third, contrast efficient multiplication of primes with difficult classical factoring of a suitable large product. Do not claim that every possible attack must begin with factoring; implementation and encoding also matter. For the fourth, explain how exchanged public values combine with local private inputs to produce agreement. Include authentication in the practical explanation, because agreement alone does not identify the other participant. For the fifth, explain hybrid efficiency: establish key material, then use symmetric protection for the bulk content. Key length and security strength differ across algorithms, and the small arithmetic examples demonstrate relationships only. A secure system combines analyzed algorithms, suitable parameters, trustworthy identity connections, and correct message protection.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About The Mathematical Building Blocks Behind Symmetric and Asymmetric Encryption Methods
What is the difference between symmetric and asymmetric encryption, and why are they combined?
Why is ECB mode considered insecure?
How does a simple RSA example work?
How does Diffie-Hellman key exchange work?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →