A couple weeks ago I was reading and experimenting with OAuth 2.0. I have been learning (it is a never ending task) and using encryption for at least a couple decades. Have developed some hashing algorithms to hash software licenses, but have never attempted to develop a full encryption algorithm.
I hold a patent (System and method of encryption for DICOM volumes) associated with the use of encryption on Commercial of the Shelf (COTS) products.
It is best to leave the actual design, implementation, testing and public review to the experts. For different reasons (including living in the same city for some years) I have purchased and read most of the books authored by Bruce Schneier. Bruce is one of the top cryptographers in the USA and probably the world. His books, with time, have shifted from focusing in cryptography (which is just one aspect of security) to general security making the subject more accessible to the masses.
I decided to purchase “Beyond Fear” mainly to read the chapter 
regarding Identification, Authentication and Authorization. The way I see it, it is always important to learn from the best. I am about to finish reading the book. I will generate a post when done.
In the book, Bruce Schneier simply defines the terms in questions as:
| Term | Definition |
| Identification | Who are you? |
| Authentication | Prove it. |
| Authorization | Here is what you are allowed to do. |
If Eve (the malicious attacker) learns my user name (e.g., for simplicity I tend to use my email address if the system allows it) or gets it from a stolen list of user names (identification) and passwords (authentication), she could pose as me to a computer system by using my user name. The system would assume that the user is being identified as John (the good guy) and not Eve.
The next step in the protocol is to authenticate the user. If Eve does not know my password, then she will not be able to authenticate as me. BUT if for some reason she was able to capture, buy, or steal my password, then the system will authenticate her as me. A security breach would occur.
Typically when you log into a system, your user name is attached to a set of credentials. Such credentials grant the holder access to hardware (e.g., printers, drives) and software (e.g., files, databases) resources. In our example, Eve would have the exact same access as I have been granted by the system administrator in that system. Eve could steal whatever she is looking for and based on my authorization delete trace files in order to cover up the breach. She could also cause other havoc like having the attached electrical power generator blow into pieces.
The key in this procedure is to provide additional and better authentication tokens (e.g., retinal scan, finger prints, pulse, and codes) and to compartmentalize access to different resources. If interested in finding more about these and related security topics, I would suggest purchasing a copy of “Beyond Fear”.
That said; the idea of asymmetric and symmetric encryption (not covered in “Beyond Fear”) came up a few days ago. I decided to write this entry given that encryption is extremely important in maintaining systems secure. That said; encryption is just a tool which may and in most cases is improperly used. In general, we humans tend to be the weakest link in security. I have books by several experts in the subject and they all seem to agree with such assessment.
In a nutshell, what is the difference between symmetric and asymmetric encryption. I first looked it up on Wikipedia and then, to get a more in depth description and additional information, read a few pages from “Applied Cryptography” by Bruce Schneier. The book was published in 1996 and most of the contents seem to be applicable and are in use today.
Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of cipher text. The keys may be identical or there may be a simple transformation to go between the two keys. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. This requirement that both parties have access to the secret key is one of the main drawbacks of symmetric key encryption, in comparison to public-key encryption (also known as asymmetric key encryption).
Asymmetric or public key cryptography is any cryptographic system that 
uses pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner. This accomplishes two functions: authentication, which is when the public key is used to verify that a holder of the paired private key sent the message, and encryption, whereby only the holder of the paired private key can decrypt the message encrypted with the public key.
In a public key encryption system, any person can encrypt a message using the public key of the receiver, but such a message can be decrypted only with the receiver’s private key. For this to work it must be computationally easy for a user to generate a public and private key-pair to be used for encryption and decryption. The strength of a public key cryptography system relies on the degree of difficulty (computational impracticality) for a properly generated private key to be determined from its corresponding public key. Security then depends only on keeping the private key private, and the public key may be published without compromising security.
RSA is one of the first practical public-key cryptosystems and is widely used for secure data transmission. In such a cryptosystem, the encryption key is public and differs from the decryption key which is kept secret. In RSA, this asymmetry is based on the practical difficulty of factoring the product of two large prime numbers, the factoring problem. RSA is made of the initial letters of the surnames of Ron Rivest, Adi Shamir, and Leonard Adleman, who first publicly described the algorithm in 1977.
A few decades ago while designing the iCAS (intelligent Content Addressable Storage) I contacted Ron Rivest to discuss if the idea of representing the contents of a digital object by a digest (specifically MD5) should be used as the name or handle. The conclusion was that there is the possibility or a collision. The resulting problem would be that two different documents could have the same name / handle. Because of that I designed a GUID which does not have such issue.
The Advanced Encryption Standard (AES), also known by its original
name Rijndael, is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001. AES is a subset of the Rijndael cipher developed by two Belgian cryptographers, Vincent Rijmen and Joan Daemen, who submitted a proposal to NIST during the AES selection process. Rijndael is a family of ciphers with different key and block sizes. For AES, NIST selected three members of the Rijndael family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits. AES has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES), which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data.
Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. It was one of the five finalists of the Advanced Encryption Standard contest, but it was not selected for standardization. Twofish is related to the earlier block cipher Blowfish. Twofish’s distinctive features are the use of pre-computed key-dependent S-boxes, and a relatively complex key schedule. One half of an n-bit key is used as the actual encryption key and the other half of the n-bit key is used to modify the encryption algorithm (key-dependent S-boxes). Twofish borrows some elements from other designs; for example, the pseudo-Hadamard transform (PHT) from the SAFER family of ciphers. Twofish has a Feistel structure like DES. Twofish also employs a Maximum Distance Separable matrix. On most software platforms Twofish was slightly slower than Rijndael (the chosen algorithm for Advanced Encryption Standard) for 128-bit keys, but it is somewhat faster for 256-bit keys. Twofish was designed by Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson.
Years ago I obtained a copy of the source written in the C programming language for the Rijndael algorithm. After purchasing and reading the book “The Design of Rijndael” by Joan Daemen and Vincent Rijmen I 
experimented with the code and started using it in different applications. I have used it primary for dynamic encryption and at rest encryption. In both cases encryption toolkits from different platforms (i.e., Linux and Windows) were able to interact with the data stored in the iCAS storage server.
If you have a comment or suggestion regarding this or any other post in this blog, please leave me a message at the end of this post. I will reply to it as soon as possible.
John
Follow me on Twitter: @john_canessa