Repository navigation
Expand file tree
/
Copy pathmodern.html
More file actions
280 lines (258 loc) · 31.5 KB
/
Copy pathmodern.html
File metadata and controls
280 lines (258 loc) · 31.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Modern Cryptography — The Cipher Museum</title>
<link rel="icon" href="favicon.svg" type="image/svg+xml">
<link rel="manifest" href="manifest.webmanifest">
<meta name="description" content="From AES and RSA to quantum cryptography — explore how modern encryption protects the digital world.">
<meta property="og:title" content="Modern Cryptography — The Cipher Museum">
<meta property="og:description" content="From AES and RSA to quantum cryptography — explore how modern encryption protects the digital world.">
<meta property="og:type" content="website">
<meta property="og:url" content="https://ciphermuseum.com/modern.html">
<meta property="og:image" content="https://ciphermuseum.com/images/og/og-default.png">
<meta property="og:image:width" content="1200">
<meta property="og:image:height" content="630">
<meta property="og:image:alt" content="The Cipher Museum — an interactive history of encryption">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="Modern Cryptography — The Cipher Museum">
<meta name="twitter:description" content="From AES and RSA to quantum cryptography — explore how modern encryption protects the digital world.">
<meta name="twitter:image" content="https://ciphermuseum.com/images/og/og-default.png">
<meta name="theme-color" content="#0a0a0f">
<link rel="canonical" href="https://ciphermuseum.com/modern.html">
<link rel="stylesheet" href="css/museum.css">
<style>
.modern-cards{display:none}
@media(max-width:768px){
.modern-table-wrap{display:none}
.modern-cards{display:flex;flex-direction:column;gap:1rem}
.mc{background:var(--s3);border:1px solid var(--s4);border-radius:var(--r);padding:1rem}
.mc-name{font-family:var(--fd);font-size:.95rem;color:var(--gold-lt);margin-bottom:.6rem}
.mc-row{display:flex;gap:.4rem;margin-bottom:.4rem;font-size:.85rem;line-height:1.6}
.mc-row:last-child{margin-bottom:0}
.mc-label{font-family:var(--fm);font-size:.6rem;letter-spacing:.12em;text-transform:uppercase;color:var(--tx3);min-width:5.5rem;flex-shrink:0;padding-top:.15rem}
.mc-val{color:var(--tx2)}
}
</style>
</head>
<body>
<a class="skip-link" href="#main-content">Skip to main content</a>
<nav class="museum-nav" aria-label="Primary"><div class="nav-inner">
<a href="index.html" class="nav-logo"><svg class="nav-logo-icon" viewBox="0 0 32 32" fill="none"><circle cx="16" cy="16" r="14" stroke="currentColor" stroke-width="1.5"/><circle cx="16" cy="16" r="8" stroke="currentColor" stroke-width="1"/><circle cx="16" cy="16" r="2" fill="currentColor"/><line x1="16" y1="2" x2="16" y2="6" stroke="currentColor" stroke-width="1.5"/><line x1="16" y1="26" x2="16" y2="30" stroke="currentColor" stroke-width="1.5"/><line x1="2" y1="16" x2="6" y2="16" stroke="currentColor" stroke-width="1.5"/><line x1="26" y1="16" x2="30" y2="16" stroke="currentColor" stroke-width="1.5"/></svg><span class="nav-logo-text">The Cipher Museum</span></a>
<ul class="nav-links">
<li><a href="museum-map.html">Explore</a></li>
<li><a href="timeline.html">Timeline</a></li>
<li><a href="learn.html">Learn</a></li>
<li><a href="cipher-corpus.html">Cipher Corpus</a></li>
<li><a href="cryptanalysis.html">Cryptanalysis</a></li>
<li><a href="challenges.html">Challenges</a></li>
<li><a href="lab/workbench.html">Lab</a></li>
<li><a href="search.html">Search</a></li>
</ul>
</div></nav>
<main id="main-content" tabindex="-1">
<div class="page-hero">
<div class="breadcrumb"><a href="index.html">Entrance</a><span>›</span>Modern Cryptography</div>
<span class="page-eyebrow">Beyond the Museum</span>
<h1 class="page-title">Modern Cryptography</h1>
<p class="page-tagline">Not just ciphers — an entirely different discipline</p>
<p style="max-width:680px;font-size:1.1rem;color:var(--tx2);line-height:1.9;position:relative;z-index:1;">This collection includes ciphers, people, historical and cultural context, mathematical foundations, hashes, signatures, and protocols. A cipher reversibly transforms plaintext into ciphertext with a key, but many exhibits explain other parts of cryptography. This page connects that broader history to modern practice.</p>
</div>
<div class="section">
<div class="section-head"><span class="section-eyebrow">The Complete Journey</span><h2 class="section-title">Classical → Modern: Compare Historical Weaknesses with Modern Design</h2></div>
<div class="panel modern-table-wrap" style="margin-bottom:3rem;">
<div class="panel-body" style="padding:0;overflow-x:auto;-webkit-overflow-scrolling:touch">
<table class="cipher-table">
<thead><tr><th>Classical Cipher Type</th><th>Historical Limitation</th><th>Modern Solution</th><th>Modern Example</th></tr></thead>
<tbody>
<tr><td>Caesar / Monoalphabetic</td><td>Frequency analysis — letter mapping preserved</td><td>Nonlinear substitution combined with diffusion and key mixing</td><td>AES SubBytes</td></tr>
<tr><td>Homophonic Substitution</td><td>One-to-many substitution can retain language and structural clues</td><td>Computational security under a defined attack model</td><td>AES in an appropriate authenticated mode</td></tr>
<tr><td>Polyalphabetic / Vigenère</td><td>Repeating key creates detectable periodicity</td><td>Pseudorandom keystreams with per-key nonce uniqueness and counter limits</td><td>ChaCha20, AES-GCM</td></tr>
<tr><td>Transposition (Rail Fence, Columnar)</td><td>Letter counts preserved; language and ordering clues can help analysis</td><td>Nonlinear substitution combined with diffusion and key mixing</td><td>AES ShiftRows + MixColumns</td></tr>
<tr><td>Playfair / Hill (block)</td><td>Small blocks leak digraph statistics; linear algebra solvable</td><td>128-bit blocks, non-linear operations, round keys</td><td>AES (128-bit block)</td></tr>
<tr><td>Fractionation (Bifid, ADFGVX)</td><td>Coordinate mixing insufficient with static key square</td><td>Multiple rounds of mixing with key-derived round keys</td><td>AES 10–14 rounds</td></tr>
<tr><td>Layered classical systems</td><td>Substitution + transposition — each layer still attackable</td><td>Multiple designed rounds; security depends on the whole construction</td><td>AES, Camellia, SM4</td></tr>
<tr><td>Machine ciphers (Enigma, Lorenz)</td><td>Physical key distribution; operator errors; structural flaws</td><td>Authenticated public-key methods help establish shared secrets</td><td>RSA, Diffie-Hellman, ECDH</td></tr>
<tr><td>One-Time Pad</td><td>Impractical key management — reuse is catastrophic</td><td>Computationally secure with short key; KDFs for key derivation</td><td>AES-256, X25519 key exchange</td></tr>
</tbody>
</table>
</div>
</div>
<!-- Mobile card layout (replaces table at ≤768px) -->
<div class="modern-cards" style="margin-bottom:3rem;">
<div class="mc">
<div class="mc-name">Caesar / Monoalphabetic</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Frequency analysis — letter mapping preserved</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Nonlinear substitution combined with diffusion and key mixing</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">AES SubBytes</span></div>
</div>
<div class="mc">
<div class="mc-name">Homophonic Substitution</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">One-to-many substitution can retain language and structural clues</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Computational security under a defined attack model</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">AES in an appropriate authenticated mode</span></div>
</div>
<div class="mc">
<div class="mc-name">Polyalphabetic / Vigenère</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Repeating key creates detectable periodicity</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Pseudorandom keystreams with per-key nonce uniqueness and counter limits</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">ChaCha20, AES-GCM</span></div>
</div>
<div class="mc">
<div class="mc-name">Transposition (Rail Fence, Columnar)</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Letter counts preserved; language and ordering clues can help analysis</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Nonlinear substitution combined with diffusion and key mixing</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">AES ShiftRows + MixColumns</span></div>
</div>
<div class="mc">
<div class="mc-name">Playfair / Hill (block)</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Small blocks leak digraph statistics; linear algebra solvable</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">128-bit blocks, non-linear operations, round keys</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">AES (128-bit block)</span></div>
</div>
<div class="mc">
<div class="mc-name">Fractionation (Bifid, ADFGVX)</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Coordinate mixing insufficient with static key square</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Multiple rounds of mixing with key-derived round keys</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">AES 10–14 rounds</span></div>
</div>
<div class="mc">
<div class="mc-name">Layered classical systems</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Substitution + transposition — each layer still attackable</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Multiple designed rounds; security depends on the whole construction</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">AES, Camellia, SM4</span></div>
</div>
<div class="mc">
<div class="mc-name">Machine ciphers (Enigma, Lorenz)</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Physical key distribution; operator errors; structural flaws</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Authenticated public-key methods help establish shared secrets</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">RSA, Diffie-Hellman, ECDH</span></div>
</div>
<div class="mc">
<div class="mc-name">One-Time Pad</div>
<div class="mc-row"><span class="mc-label">Weakness</span><span class="mc-val">Impractical key management — reuse is catastrophic</span></div>
<div class="mc-row"><span class="mc-label">Solution</span><span class="mc-val">Computationally secure with short key; KDFs for key derivation</span></div>
<div class="mc-row"><span class="mc-label">Example</span><span class="mc-val">AES-256, X25519 key exchange</span></div>
</div>
</div>
<div class="section-head"><span class="section-eyebrow">Shannon's Framework</span><h2 class="section-title">Confusion & Diffusion</h2></div>
<div class="cd-grid" style="display:grid;grid-template-columns:1fr 1fr;gap:2rem;margin-bottom:3rem;">
<div class="panel" style="border-color:var(--gold-b);">
<div class="panel-head" style="background:var(--gold-glow);border-color:var(--gold-b);"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-puzzle"/></svg></span><span class="panel-title" style="color:var(--gold);">Confusion</span></div>
<div class="panel-body">
<p>Making the relationship between key and ciphertext as complex as possible. Caesar has a simple key relationship: C = P + 3. One known pair reveals the entire key.</p>
<p style="margin-top:.75rem;"><strong>Modern solution:</strong> AES S-boxes are highly non-linear. The S-box has a precise public algebraic definition. Its nonlinearity works with the other round operations; an S-box alone does not make encryption secure.</p>
</div>
</div>
<div class="panel" style="border-color:var(--gold-b);">
<div class="panel-head" style="background:var(--gold-glow);border-color:var(--gold-b);"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-globe"/></svg></span><span class="panel-title" style="color:var(--gold);">Diffusion</span></div>
<div class="panel-body">
<p>Spreading each plaintext bit's influence across many ciphertext bits. Caesar does not spread changes across letter positions: change one letter, change exactly one ciphertext letter.</p>
<p style="margin-top:.75rem;"><strong>Modern solution:</strong> AES combines ShiftRows and MixColumns to spread byte dependencies. Across suitable inputs, changing one bit of a full AES input changes about half the output bits on average; this is not an exact per-message promise or a standalone security proof.</p>
</div>
</div>
</div>
<div class="section-head"><span class="section-eyebrow">The Modern Landscape</span><h2 class="section-title">What Replaced Classical Cryptography</h2></div>
<div class="callout" style="margin-bottom:2.5rem;border-color:var(--gold-b);background:var(--gold-glow);">
<span class="callout-icon">⚠️</span>
<div class="callout-body"><p><strong>Taxonomy note:</strong> Symmetric and public-key encryption schemes both reversibly transform plaintext into ciphertext. RSA encryption and RSA signatures are distinct schemes with different encoding and padding requirements. Diffie–Hellman establishes shared secrets; signatures authenticate messages; hash functions produce digests. These primitives solve different problems and must be combined with appropriate protocols.</p></div>
</div>
<div class="callout" style="margin-bottom:2.5rem;border-color:var(--gold-b);background:var(--gold-glow);">
<span class="callout-icon">🏛️</span>
<div class="callout-body"><p><strong>Looking for the exhibits?</strong> Explore these constructions — <a href="ciphers/des.html" style="color:var(--gold);">DES</a>, <a href="ciphers/diffie-hellman.html" style="color:var(--gold);">Diffie-Hellman</a>, <a href="ciphers/rsa.html" style="color:var(--gold);">RSA</a>, <a href="ciphers/aes.html" style="color:var(--gold);">AES</a>, and <a href="ciphers/sha256.html" style="color:var(--gold);">SHA-256</a> — and further exhibits in <a href="halls/modern-crypto.html" style="color:var(--gold);">Hall XI · Modern Cryptography</a>. This page provides the wider context: the journey from classical failure to modern practice, and additional constructions such as ChaCha20, ECDH and post-quantum schemes.</p></div>
</div>
<!-- ── 🔐 Ciphers ── -->
<div style="margin-bottom:2.5rem;">
<div style="font-family:var(--fm);font-size:.6rem;letter-spacing:.25em;text-transform:uppercase;color:var(--gold);margin-bottom:1rem;padding-bottom:.5rem;border-bottom:1px solid var(--s4);">🔐 Ciphers — Plaintext → Ciphertext → Plaintext</div>
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:1rem;">
<a href="ciphers/aes.html" class="panel" style="text-decoration:none;color:inherit;display:block;"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-diamond"/></svg></span><span class="panel-title">AES-256 (Symmetric) <span style="color:var(--gold);font-size:.7rem;">→ exhibit</span></span></div><div class="panel-body"><p>128-bit blocks, 256-bit key, 14 rounds. 2²⁵⁶ possible keys; no practical key-recovery attack is known against correctly used full-round AES. Protocol, mode and implementation failures remain separate risks.</p>
</div></a>
<div class="panel"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-globe"/></svg></span><span class="panel-title">ChaCha20 (Stream Cipher)</span></div><div class="panel-body"><p>Designed by Daniel Bernstein. Original ChaCha uses a 64-bit nonce and 64-bit block counter. IETF ChaCha20 (RFC 8439) uses a 256-bit key, 96-bit nonce, and 32-bit block counter. Both XOR plaintext with a deterministic pseudorandom keystream: never reuse a nonce under the same key, and never let the block counter wrap. <a href="https://cr.yp.to/chacha/chacha-20080128.pdf" target="_blank" rel="noopener noreferrer">Original specification</a>; <a href="https://www.rfc-editor.org/rfc/rfc8439.html#section-2.3" target="_blank" rel="noopener noreferrer">RFC 8439 §§2.3, 4</a> and <a href="https://www.rfc-editor.org/errata/rfc8439" target="_blank" rel="noopener noreferrer">errata</a>.</p></div></div>
</div>
</div>
<!-- ── 🔑 Key Exchange ── -->
<div style="margin-bottom:2.5rem;">
<div style="font-family:var(--fm);font-size:.6rem;letter-spacing:.25em;text-transform:uppercase;color:var(--gold);margin-bottom:1rem;padding-bottom:.5rem;border-bottom:1px solid var(--s4);">🔑 Key Exchange — Creating a Shared Secret</div>
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:1rem;">
<a href="ciphers/diffie-hellman.html" class="panel" style="text-decoration:none;color:inherit;display:block;"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-person"/></svg></span><span class="panel-title">Diffie-Hellman Key Exchange <span style="color:var(--gold);font-size:.7rem;">→ exhibit</span></span></div><div class="panel-body"><p>Derives a shared secret over a public channel. Computing the shared group element is the computational Diffie–Hellman problem. Discrete logarithms provide one route to solving it; protocol security also needs authentication. <em>Not a cipher — it does not encrypt data.</em></p>
</div></a>
</div>
</div>
<!-- ── 🔓 Public-Key Cryptography ── -->
<div style="margin-bottom:2.5rem;">
<div style="font-family:var(--fm);font-size:.6rem;letter-spacing:.25em;text-transform:uppercase;color:var(--gold);margin-bottom:1rem;padding-bottom:.5rem;border-bottom:1px solid var(--s4);">🔓 Public-Key Cryptography — Asymmetric Encryption & Signatures</div>
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:1rem;">
<a href="ciphers/rsa.html" class="panel" style="text-decoration:none;color:inherit;display:block;"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-key"/></svg></span><span class="panel-title">RSA (Asymmetric) <span style="color:var(--gold);font-size:.7rem;">→ exhibit</span></span></div><div class="panel-body"><p>Rivest, Shamir, Adleman (1977). Two keys — public (encrypt) and private (decrypt) — based on arithmetic modulo a product of large primes; factoring that composite reveals the private key. Used in TLS, email, and digital signatures.</p>
</div></a>
</div>
</div>
<!-- ── #️⃣ Hash Functions ── -->
<div style="margin-bottom:2.5rem;">
<div style="font-family:var(--fm);font-size:.6rem;letter-spacing:.25em;text-transform:uppercase;color:var(--gold);margin-bottom:1rem;padding-bottom:.5rem;border-bottom:1px solid var(--s4);">#️⃣ Hash Functions — One-Way Fingerprints</div>
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:1rem;">
<a href="ciphers/sha256.html" class="panel" style="text-decoration:none;color:inherit;display:block;"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-lock"/></svg></span><span class="panel-title">SHA-256 (Hash Function) <span style="color:var(--gold);font-size:.7rem;">→ exhibit</span></span></div><div class="panel-body"><p>Produces a fixed 256-bit digest of a message shorter than 2⁶⁴ bits. Preimage resistance means finding an input for a chosen digest should be computationally difficult; low-entropy inputs can still be guessed. Generic collision search takes roughly 2¹²⁸ work, rather than having a proven exact lower bound. Used in digital signatures, certificate verification, blockchain. <em>A hash is not a reversible encryption scheme; guessed inputs can still be tested.</em></p>
</div></a>
</div>
</div>
<!-- ── 🔮 Future ── -->
<div style="margin-bottom:3rem;">
<div style="font-family:var(--fm);font-size:.6rem;letter-spacing:.25em;text-transform:uppercase;color:var(--gold);margin-bottom:1rem;padding-bottom:.5rem;border-bottom:1px solid var(--s4);">🔮 The Future — Post-Quantum Cryptography</div>
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:1rem;">
<div class="panel"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-flask"/></svg></span><span class="panel-title">Post-Quantum Cryptography</span></div><div class="panel-body"><p>Sufficiently large, fault-tolerant quantum computers could break conventional RSA and Diffie–Hellman using Shor’s algorithm. NIST standardized the first three algorithms from its post-quantum project in 2024: <strong>ML-KEM</strong> (formerly CRYSTALS-Kyber, key encapsulation) and <strong>ML-DSA</strong> (formerly CRYSTALS-Dilithium, signatures), both based on structured lattice problems. NIST also standardized the hash-based SLH-DSA signature scheme in 2024. These are intended to resist known quantum attacks; they are not proofs against every future attack. The mathematics is on exhibit in the Hall of Foundations: <a href="hall-of-foundations/lattices-svp.html">lattices & the SVP</a>, <a href="hall-of-foundations/closest-vector.html">the closest-vector problem</a>, <a href="hall-of-foundations/learning-with-errors.html">Learning With Errors</a> — an introduction to the mathematical setting of lattice-based standards — and <a href="hall-of-foundations/polynomial-rings.html">polynomial rings</a>.</p></div></div>
<div class="panel"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-quill"/></svg></span><span class="panel-title">Elliptic-Curve Signatures <span style="color:var(--gold);font-size:.7rem;">→ exhibit</span></span></div><div class="panel-body"><p><a href="ciphers/ecdsa.html">ECDSA</a> signatures verify under a public key rather than concealing content; attribution to a person requires a trusted key association: a private scalar on an elliptic curve, a public point, and a signature anyone can check. Suitable 256-bit elliptic-curve groups and 3072-bit RSA are commonly compared at roughly 128 bits of classical security, under their respective assumptions. Security requires an appropriate curve and implementation. Reused or biased nonces, side-channel leakage, faults and validation errors can compromise a signer. Shor’s algorithm also applies to the elliptic-curve discrete logarithm problem. The group law is in <a href="hall-of-foundations/elliptic-curves-real.html">the Hall of Foundations</a>.</p></div></div>
<div class="panel"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-puzzle"/></svg></span><span class="panel-title">Threshold Secret Sharing <span style="color:var(--gold);font-size:.7rem;">→ exhibit</span></span></div><div class="panel-body"><p><a href="ciphers/shamir-secret-sharing.html">Shamir’s Secret Sharing</a> (1979) represents the secret in a finite field and samples the remaining polynomial coefficients independently and uniformly. With distinct nonzero share coordinates, k valid shares reconstruct the secret; fewer than k preserve its prior distribution. This information-theoretic property also holds against quantum computation, but does not protect stolen shares or faulty implementations. Threshold signing protocols can build on secret-sharing ideas but require additional protections; plain Shamir sharing does not authenticate shares or perform signatures.</p></div></div>
<div class="panel"><div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-mask"/></svg></span><span class="panel-title">Zero-Knowledge Proofs <span style="color:var(--gold);font-size:.7rem;">→ exhibit</span></span></div><div class="panel-body"><p><a href="ciphers/zero-knowledge-proofs.html">Zero-knowledge proofs</a> combine a soundness guarantee with a specified bound on what the verifier can learn beyond the statement. The guarantee depends on the protocol and security model; toy protocols can have a visible nonzero soundness error. The succinct variants — zk-SNARKs and STARKs — validate private transactions and compress whole blocks of computation into a proof small enough to check on a blockchain. The Fiat–Shamir transformation connects certain interactive identification protocols to noninteractive proofs or signatures under additional assumptions. A signature is not automatically a general-purpose zero-knowledge proof.</p></div></div>
</div>
</div>
<section class="panel" id="replay-freshness" aria-labelledby="replay-heading">
<div class="panel-body">
<h2 id="replay-heading">A valid tag can belong to an old message</h2>
<p>Suppose A carries counter 1 and B carries counter 2. Each tag covers the counter and message under the same session key. An observer records both. Compare a receiver that remembers only the last token with one that accepts a valid tag only when its counter exceeds the highest accepted counter, initially 0.</p>
<p class="ebook-table-hint">Swipe or scroll the table horizontally to see every column. Keyboard: focus the table area and use the arrow keys.</p>
<div class="ebook-table-scroll" tabindex="0" role="region" aria-label="Replay and receiver-state comparison">
<table class="cipher-table" id="replay-example">
<caption>Deliver A, B, then A again; authenticate before updating state</caption>
<thead><tr><th scope="col">Delivery</th><th scope="col">Tag check</th><th scope="col">Last-token-only rule</th><th scope="col">Increasing-counter rule</th></tr></thead>
<tbody>
<tr><td>A (1)</td><td>Valid</td><td>Accept</td><td>Accept; highest = 1</td></tr>
<tr><td>B (2)</td><td>Valid</td><td>Accept</td><td>Accept; highest = 2</td></tr>
<tr><td>A (1), replayed</td><td>Valid</td><td>Accept</td><td>Reject; highest = 2</td></tr>
<tr><td>A changed to counter 3; old tag</td><td>Invalid</td><td>Reject</td><td>Reject; highest = 2</td></tr>
<tr><td>Forget receiver state, keep key; replay A (1)</td><td>Valid</td><td>Accept</td><td>Accept; highest = 1</td></tr>
</tbody>
</table>
</div>
<p>The A/B/A sequence defeats last-token-only checking. Resetting state under the unchanged key defeats the counter rule too. Rejected packets must not advance the accepted counter. This simplified rule rejects out-of-order messages; transports that allow reordering need a defined replay window and session lifecycle, including counter exhaustion. Replaying recorded ciphertext does not require encrypting a new message with a reused nonce: sender nonce uniqueness and receiver freshness are separate requirements.</p>
<p>Try the existing <a href="https://systemslibrarian.github.io/crypto-lab-fte/">Crypto Lab: Regex Veil</a>, in its <strong>Freshness</strong> section: open authenticated fragments twice, then reset the used-counter window. It is a local protocol teaching model, not a deployed transport.</p>
<p class="source-note">Sources: Ross Anderson, <em>Security Engineering: A Guide to Building Dependable Distributed Systems</em>, third edition (2020), §4.3, printed pp. 122–124 (PDF pp. 169–171); David Wong, <em>Real-World Cryptography</em> (2021 edition), §3.3.3, PDF pp. 140–143 in the reflowed edition, which has no printed pagination. The table is a museum teaching example.</p>
</div>
</section>
<div class="callout callout-mystery">
<span class="callout-icon">🎓</span>
<div class="callout-body"><p><strong>The museum's final lesson:</strong> Many historical systems failed through structural weaknesses, key reuse, or operational mistakes; others are obsolete or unresolved. A correctly used one-time pad retains perfect secrecy. Modern cryptography adds computational security and public-key methods, while still depending on sound key management, and extends into protocols, signatures, and proofs.</p></div>
</div>
<div class="section-head" style="text-align:left;margin-top:3rem;">
<span class="section-eyebrow">Continue Learning</span>
<h2 class="section-title">Resources</h2>
</div>
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:1rem;margin-bottom:2rem;">
<div class="panel">
<div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-gear"/></svg></span><span class="panel-title">CrypTool-Online</span></div>
<div class="panel-body"><p>Free browser-based cryptography toolkit. Encrypt and decrypt with dozens of classical and modern ciphers. Visualize algorithms step by step.</p></div>
</div>
<div class="panel">
<div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-book"/></svg></span><span class="panel-title">The Code Book</span></div>
<div class="panel-body"><p>Simon Singh’s <em>The Code Book</em> traces the history of cryptography from ancient Egypt to quantum computing. A popular historical introduction, first published in 1999.</p></div>
</div>
<div class="panel">
<div class="panel-head"><span class="panel-icon" aria-hidden="true"><svg class="icon" width="17" height="17"><use href="images/icons.svg#i-signal"/></svg></span><span class="panel-title">Cryptography I (Stanford)</span></div>
<div class="panel-body"><p>Dan Boneh’s Coursera course covers modern cryptographic primitives: stream ciphers, block ciphers, MACs, public-key encryption, and key exchange.</p></div>
</div>
</div>
</div>
<section class="section"><h2>Research case studies: what was actually attacked?</h2><p><a href="ciphers/ua-8295.html">UA-8295: altered firmware and forensic evidence</a> · <a href="ciphers/sodark.html">SoDark: eight-round radio linking protection</a> · <a href="ciphers/nfc-deployment.html">NFC: authentication, configuration and counterfeit hardware</a></p><p><a href="lab/modern-attack-evidence.html">Compare GPU search, GPRS faults and conditional-linear DES</a>. Each result identifies the target, attacker access and limits of the evidence.</p></section>
</main>
<footer></footer>
<script src="js/nav.js" defer></script>
<script src="js/lightbox.js"></script>
</body></html>