Symmetric +ciphers -- guide

What are symmetric ciphers?
Block and stream ciphers
Types of symmetric algorithms supported
Base classes and their derived classes

What are symmetric +ciphers?

Symmetric algorithms are much faster than asymmetric +algorithms so are used to encrypt and decrypt large amounts of data. In an +informal setting, symmetric ciphers can be thought of as a mapping of some +plaintext to ciphertext, via some well-known transformation function, dependent +on a single secret key. Symmetric algorithms have the property that if a message +is encrypted under a given key, it can only be decrypted using the same key:

+ The diagram above shows the encryption and decryption process using: +a symmetric algorithm; a plaintext message, M; a symmetric key, K; and the +ciphertext, K(M). + +

So it provides secrecy and also some kind of authentication. If +Alice encrypts a secret using a key known only to her, then only she can access +the secrets.

It can also be used for communication: if Alice shares +a key with Bob (and only Bob), then she can encrypt her messages with that +key and send it to Bob, and only Bob can decrypt them. In this case the key +is a 'shared secret' enabling private communications.

There are two +basic types of symmetric ciphers: block +ciphers and stream ciphers.

Block and stream +ciphers

Stream ciphers are +essentially functions that are initialized with a key, and output a stream +of pseudorandom bits, this 'keystream' is typically XOR-ed with the plaintext +to generate the ciphertext. So they encrypt a bit of plaintext at a time. +They map an n -bit stream of plaintext to a n -bit stream of +ciphertext.
Block ciphers encrypt +several bits at once in a fixed-size block. That is, they map m n -bit +blocks of plaintext to m n -bit blocks of ciphertext. The cipher +and its mode of operation define the block size: the plaintext is split up +into appropriately-sized blocks and each block is fed into the cipher.

There +are two issues here that don't occur with stream ciphers:
- padding: the +total size of the input has to be a multiple of the block size, so the plaintext +usually has to be padded to fit (see the class CPadding). +Optionally, instead of padding out a plaintext message to fit in a block, +block ciphers allow buffering of partial input blocks until the remainder +of the block is given as input. (see How +does buffering work within the symmetric cipher framework? and PKCS#7).
- combining blocks: +if you just encrypt each plaintext block with the cipher and then concatenate +the ciphertext blocks, then an attacker who knows something about the structure +can switch the order of the ciphertext blocks to alter the meaning of the +message. For example, if the plaintext includes instructions like 'pay £XXX +to account holder ABC, reference number YYY', then an attacker could replace +the encryption of XXX with some of the encryption of YYY. This leads to other +techniques for combining blocks, called modes, where, for example, the output +of the last block is fed into the input for the next one. So, the output is +not just a function of that plaintext block and key, but is a function of +that plaintext block, the key, and all preceding ciphertext blocks (see Symmetric +Modes).

Both stream ciphers and block ciphers are provided by the API with +a similar interface. Block ciphers usually need padding for non completed +blocks. The API allows the user to choose the padding to be added at the end +of the last encrypted block or to be checked and removed from the last decrypted +block.

Types of symmetric +algorithms supported

The following symmetric algorithms are supported:

+ + + +Symmetric algorithm +Type +Specified in: + + + + +

AES (Advanced Encryption Standard)

Block cipher

FIPS-197

+ + +

DES (Data Encryption Standard)

Block cipher

FIPS 46-3

+ + +

3DES (Triple Data Encryption Standard)

Block cipher

FIPS 46-3

+ + +

RC2-128

Block cipher

RFC +2268

+ + +

ARC4 ('alleged' RC4)

Stream cipher

the internet and a posting to sci.crypt in 1994.

+ + + +

Base classes +and their derived classes

The symmetric cipher API is used by Networking +(TLS/IPSec).

CSymmetricCipher is the abstract +base class that allows a client to use the supported symmetric algorithms +listed above. It allows clients to encrypt and decrypt without having to know +anything about which encryption algorithm is currently in use.

The +PKCS5 API (the TPKCS5KDF class, also see Password +Based Encryption) offers Key Derivation Support that allows the derivation +of deterministic arbitrary length byte streams from an input string. The output +byte stream is generated using multiple iterations of a SHA-1 message digest +(CSHA1) and is suitable for use as a cryptographic symmetric +key.

The diagrams below show the main classes used in symmetric cipher +framework. Blue dotted arrows indicate that a class is contained or used by +another class. The arrows are labelled with the variable(s) through which +the pointed class is accessible. The colour of the boxes indicates the type +of Symbian class, i.e., M, C, R or T class. +For detailed information on each component see the Cryptography API Reference +material.

CSymmetricCipher and derived classes

+The inheritance diagram shows the <codeph>CSymmetricCipher</codeph> abstract +base class and its derived abstract classes <codeph>CBufferedTransformation</codeph> and <codeph>CStreamCipher</codeph> used +for block and stream ciphers respectively. Also shown are the following derived +classes: <codeph>CBufferedDecryptor</codeph>, <codeph>CBufferedEncryptor</codeph>, <codeph>CARC4</codeph>, +and <codeph>CNullCipher</codeph>. + +

CBlockTransformation and derived classes

+The inheritance diagram above shows the <xref href="GUID-CFDA5321-EE13-3203-8DED-71E69D4469BD.dita"><apiname>CBlockTransformation</apiname></xref> abstract +base class used for block ciphers. Also shown are the following derived classes: <xref href="GUID-436C3EBE-FC60-3760-A3BA-D8DF8FA5B8AF.dita"><apiname>CBlockChainingMode</apiname></xref>, <xref href="GUID-C65A1F55-A8D2-3393-8DC1-35656017E2B8.dita"><apiname>CModeCBCEncryptor</apiname></xref>, <xref href="GUID-7D5FBD2C-83A0-351A-96B3-C5C54FE525E6.dita"><apiname>CModeCBCDecryptor</apiname></xref>, <xref href="GUID-1C18ED2F-085F-3C3E-A93E-5FD37461E440.dita"><apiname>CDES</apiname></xref>, <xref href="GUID-E7401D77-AD0E-3B8F-A7CC-23ADA5151DB6.dita"><apiname>CDESEncryptor</apiname></xref>, <xref href="GUID-249270AC-907B-3E46-AFDB-131FDC6F612A.dita"><apiname>CDESDecryptor</apiname></xref>, <xref href="GUID-90A671B0-756E-3773-8429-6441D1594F4B.dita"><apiname>C3DES</apiname></xref>, <xref href="GUID-B931DBB9-4484-33FD-9E94-6F256ABD5C68.dita"><apiname>C3DESEncryptor</apiname></xref>, <xref href="GUID-C693C22D-04C5-3C9E-8605-0EA90F723AF3.dita"><apiname>C3DESDecryptor</apiname></xref>, <xref href="GUID-BEE18CDE-CFB6-3116-9FAE-046780D4D006.dita"><apiname>CRC2</apiname></xref>, <xref href="GUID-19F20C86-5722-3A35-B17D-3830D18CC7FC.dita"><apiname>CRC2Encryptor</apiname></xref>, <xref href="GUID-E6FD8DF9-258B-39BC-8C39-ABF7434A29B5.dita"><apiname>CRC2Decryptor</apiname></xref>, <xref href="GUID-B0AEE24A-91A6-335E-AD64-C9DDCC1F81A9.dita"><apiname>CRijndael</apiname></xref>, <xref href="GUID-AE1A9AC0-DB79-3C62-AA23-896812F25F14.dita"><apiname>CAESEncryptor</apiname></xref>, and <xref href="GUID-51666543-0256-3E0D-BF5F-8716753C5921.dita"><apiname>CAESDecryptor</apiname></xref>. + +

CPadding and derived +classes

+Above is an inheritance diagram showing the CPadding abstract base +class used with block ciphers. Also shown are the following derived classes: <xref href="GUID-B7090C61-ECC7-3E8A-8D19-75C9170B0135.dita"><apiname>CPaddingPKCS7</apiname></xref>, <xref href="GUID-3150ECC9-CF8E-3890-91CD-87F5EBCE550E.dita"><apiname>CPaddingPKCS1Encryption</apiname></xref>, <xref href="GUID-F845CB30-7ABE-3EB6-B1B9-C72581897D0C.dita"><apiname>CRSAPKCS1v15Encryptor</apiname></xref>, <xref href="GUID-57C40DCA-8340-38B5-9777-2863C8F88B59.dita"><apiname>CPaddingNone</apiname></xref>, <xref href="GUID-723F64D1-01C5-3A03-B987-0FB862EE8EDE.dita"><apiname>CPaddingPKCS1Signature</apiname></xref>, +and <xref href="GUID-CC2347BE-3272-3DDF-8BDD-B44F5C0026B3.dita"><apiname>CPaddingSSLv3</apiname></xref> + +