Chapter 5 — Security literacy

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 What cryptography is for"]
  N2["5.2 Four tools"]
  N3["5.3 Common misconceptions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 What cryptography is for"]
  N2["5.2 Four tools"]
  N3["5.3 Common misconceptions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 What cryptography is for]
    |
    v
[5.2 Four tools]
    |
    v
[5.3 Common misconceptions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) recognise the goals cryptography serves; (2) distinguish encryption, hashing, MACs and signatures; (3) spot common misconceptions.

5.1 What cryptography is for

Priya lists the goals cryptography serves: confidentiality, keeping data secret; integrity, detecting changes; authentication, confirming who sent something; and non-repudiation, preventing a signer from denying a signature. She maps Tidewell examples: patron reading history needs confidentiality, catalogue exports need integrity, staff logins need authentication and signed contracts with e-book publishers benefit from non-repudiation. Each goal needs different tools, and confusing them is the root of many errors she will meet later. She pins the four goals above every later design discussion, so that each proposed tool must name the goal it serves.

5.2 Four tools

Encryption provides confidentiality with a key; AES in FIPS 197 is the standard symmetric cipher. Hash functions such as SHA-256 provide a fixed-size fingerprint without a key. Message authentication codes such as HMAC from RFC 2104 provide integrity and authentication between parties sharing a key. Digital signatures, such as ECDSA in FIPS 186-5 or Ed25519 in RFC 8032, provide integrity, authentication and non-repudiation using a private key to sign and a public key to verify. Priya draws a table of which tool meets which goal.

5.3 Common misconceptions

Priya collects misconceptions from staff interviews at Tidewell: "the website has a padlock, so our data is safe everywhere"; "we hash backups, so they are encrypted"; "a longer password is always a stronger password"; and "encryption means nobody can change the data". She corrects each: TLS protects only the connection; hashing is not encryption; length helps only if the password is not predictable; and unauthenticated encryption may allow undetected tampering, which is why authenticated encryption such as AES-GCM is preferred.

Worked example

Priya maps four goals to Tidewell examples, builds a tool-goal table, and corrects four staff misconceptions.

Synthetic case. The staff quotes are invented.

Errors and limits

Simplified tables omit nuances such as authenticated encryption combining goals. Non-repudiation also depends on key protection and legal context.

Exercises

• EX013 — Goal mapping. Which goal do signed publisher contracts serve? Rubric: 3 = non-repudiation (plus integrity and authentication);; 2 = integrity;; 1 = confidentiality;; 0 = none.
• EX014 — MAC versus signature. How does a MAC differ from a signature? Rubric: 3 = MAC uses a shared key, no non-repudiation; signature uses private/public keys and supports non-repudiation;; 2 = partial;; 1 = same;; 0 = none.
• EX015 — Padlock misconception. Correct "the padlock means our data is safe everywhere". Rubric: 3 = TLS protects only the connection, not data stored on servers;; 2 = partial;; 1 = agree;; 0 = none.

Synthesis

Knowing what each cryptographic tool achieves, and what it does not, is the foundation of security literacy.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →