11 · Security & Cryptography

This chapter is not a floor of the tower but a stairwell cut through all of them — an attacker enters on whichever floor you left unguarded, and is under no obligation to use the door you built.

How do strangers build trust over a wire?

In November 1976 the IEEE Transactions on Information Theory carried a paper opening with a sentence academics almost never allow themselves: "We stand today on the brink of a revolution in cryptography" (Diffie & Hellman, 1976). The problem it dissolved was thousands of years old, and it was not that codes kept getting broken. It was a delivery problem. Every cipher in history — Caesar's, Mary Stuart's, Enigma's — required that sender and receiver already share a secret key: a courier, a meeting, a locked bag. Scrambling the message was never the hard part. Getting the key to the far end untouched was, and on a planetary network of strangers who will never meet, it looked impossible.

It is not. Two people who have never met can shout across a room where everyone is listening and writing everything down, and finish sharing a number no listener can compute.

The strangest part of that revolution is that it had already happened, in silence. In a January 1970 report, James Ellis of Britain's GCHQ argued that "non-secret encryption" was possible; Clifford Cocks built a working scheme in 1973 and Malcolm Williamson another in 1974. All of it was classified. GCHQ released the papers on 17 December 1997, the day before Cocks announced them in public — a month after Ellis had died on 25 November 1997, never permitted to say what he had done (GCHQ).

Assume the enemy has your blueprints. In 1883 Auguste Kerckhoffs published six requirements for a field cipher in the Journal des sciences militaires. Five are period furniture. The second has outlived them all: the system "must not require secrecy and can be stolen by the enemy without causing trouble" (Kerckhoffs, 1883). Claude Shannon restated the rule in the 1949 paper that made cryptography a mathematical science (Communication Theory of Secrecy Systems), and modern standards still say it plainly — security "should not depend on the secrecy of the implementation or its components" (NIST SP 800-123). A key can be replaced in seconds by one person; a hidden design baked into a million shipped devices cannot be replaced at all, needing only one captured device to become public. Concentrate the secrecy in the smallest, most replaceable thing you own. That thing is the key.

Some doors swing one way. Multiplying two large primes takes a modern processor a fraction of a millisecond. Recovering those primes from the product has no known classical method that finishes in a useful lifetime. Cryptography lives inside gaps like this — computations cheap forward and ruinous backward. Here is the honest part: nobody has proved such functions exist. Their existence would imply P ≠ NP; the reverse implication is not known, so even settling that famous question would not settle this one (status). Every encrypted payment and every signed software update rests on a conjecture that has survived fifty years of attack — which is evidence, not proof.

A secret can be agreed in public. The Diffie–Hellman construction is worth understanding once, because it feels like sleight of hand and is not. Both parties agree publicly on a large prime and a base number. Each privately picks an exponent, raises the base to it, and shouts the result. Each then raises the other person's shouted number to their own private exponent. Both arrive at the same value, because exponentiation does not care about the order. An eavesdropper holds both public results and cannot get there, because recovering an exponent from its result — the discrete logarithm — is one of those one-way doors. Two years later, Rivest, Shamir and Adleman turned the same asymmetry the other way round (RSA, 1978): not hiding a message, but signing it, so anyone can check who wrote it and no one can forge it. Diffie and Hellman received the Turing Award for 2015 (ACM).

Encryption is one promise out of three, and usually not the one you needed. Confidentiality means nobody else can read it. Integrity means nobody altered it in flight. Authentication means it came from who it claims. These are separable, and the failure mode is unglamorous: an attacker who cannot read your ciphertext may still flip bits inside it, or replay yesterday's valid message today. Most real protocol disasters are integrity or authentication failures wearing an encrypted coat.

Design against an adversary, not for a user. Every other floor in this tower asks whether a system works. This one asks what happens when someone actively wants it not to — and gets to choose the floor. Saltzer and Schroeder set out the discipline in 1975 in eight principles that have not needed revision: economy of mechanism, fail-safe defaults, complete mediation, open design, separation of privilege, least privilege, least common mechanism, psychological acceptability (Proc. IEEE 63(9)). Least privilege is the one to carry: every component gets exactly the authority its job requires, so a compromise stays local. Heartbleed, disclosed on 7 April 2014, was a missing bounds check in OpenSSL that let any stranger ask a server for a slice of its own memory (CISA) — no cipher was broken; a leak two floors down drained the secrets held above it. That is chapter 00's law of leaky abstractions with an adversary standing at the crack.

The weakest layer is the one made of people. The Morris worm of 2 November 1988 spread through an estimated 6,000 of roughly 60,000 connected machines (FBI) — an estimate, still quoted as one. The ratio has not improved: Verizon's 2026 Data Breach Investigations Report, covering incidents from 1 November 2024 to 31 October 2025, finds a human element in 62% of breaches (DBIR). Mathematics defends the wire. It does not defend the person who is tired at the end of a shift.

A clock is running on all of it. Peter Shor showed in 1994 that a sufficiently large quantum computer would factor integers and compute discrete logarithms efficiently — dissolving exactly the two one-way doors that public-key cryptography stands on. No such machine exists (chapter 14 weighs how far away it is), but encrypted traffic recorded today can be decrypted the day one arrives, a strategy standards bodies now name openly as harvest now, decrypt later (NIST IR 8547). The replacement is already standardized: NIST finalized FIPS 203, 204 and 205 on 13 August 2024, and selected the code-based algorithm HQC as a backup on 11 March 2025 (NIST). The engineering problem is not inventing the new mathematics. It is finding, in a civilization's worth of software, every place the old mathematics was quietly assumed.

Connections

Below: chapter 03 supplies the raw material — a key is only as good as its unpredictability, which entropy measures. Chapters 04 and 05 hold the roots of trust, since a kernel that can be subverted makes every guarantee above it decorative. Alongside: chapter 09 explains why the internet's naming and routing were built for a cooperative world and had authentication bolted on later, and chapter 10 asks how parties agree when some of them have merely crashed — this chapter's adversary upgrades crashing to lying. Above: chapter 12, where the adversary attacks the training data rather than the wire.

Open questions

Do one-way functions exist? Everything in this chapter is a bet that they do. Can the world's deployed cryptography be migrated to post-quantum algorithms before a cryptographically relevant quantum computer exists, given that nobody knows the date of either event? And the question the field keeps failing rather than solving: can systems be made secure and usable, given that Saltzer and Schroeder listed psychological acceptability fifty years ago and it remains the least-honoured of their eight principles?

Go deeper

• Alfred Menezes, Paul van Oorschot & Scott Vanstone, Handbook of Applied Cryptography, CRC Press, 1996 — the standard reference, all chapters free with the publisher's permission at cacr.uwaterloo.ca/hac.
• Whitfield Diffie & Martin Hellman, "New Directions in Cryptography," IEEE Transactions on Information Theory IT-22, no. 6 (1976): 644–654 — PDF.
• Jerome Saltzer & Michael Schroeder, "The Protection of Information in Computer Systems," Proceedings of the IEEE 63, no. 9 (1975): 1278–1308 — PDF.