Cryptographic Technologies and Authentication

Learning Objectives

• Explain how HTTPS secures communication: how the TLS handshake uses public-key cryptography to share a key safely, and how common-key cryptography then protects the data that follows.
• Describe how authentication, including multi-factor authentication, is used in real services, and explain why security technologies are combined.

Guiding Question

“How do cryptographic technologies and authentication work together to keep online communication and services secure?”

Every time you log in to a bank app, buy something online, or open a website with a small padlock in the address bar, hidden technologies are working to keep your information safe. Messages are scrambled so no one else can read them, the website proves that it is genuine, and your identity is checked before you are granted access. Without these protections, passwords could be stolen and private data could be read by unauthorized people.

Key Fact. Secure online communication and services depend on combining cryptography and authentication, not on any single technology.

1. How HTTPS Communication Works

HTTPS (HTTP Secure) is a communication protocol that adds TLS encryption to HTTP. By providing encryption, detection of tampering, and verification of the communication partner, it protects users from threats such as eavesdropping, tampering, and impersonation. The procedure for establishing a secure communication is called the TLS handshake.

HTTPS Communication Flow: connection, key exchange, then data transfer.

HTTPS combines common-key (symmetric-key) cryptography and public-key cryptography so that it can take advantage of the strengths of both. Public-key cryptography is used to share keys safely, and common-key cryptography is used to exchange large amounts of data quickly. This division of roles makes it possible to achieve both security and communication speed.

Note from the textbook: the exchange above shows one way a common key can be shared. Current versions of TLS use Diffie-Hellman key agreement instead.

A public key locks; a different private key unlocks.

Going Deeper

Picture a box with an unusual lock. It comes with two different keys: one can only lock it, the other can only open it. The website keeps the opening key, called the private key, and never sends it anywhere. It hands out copies of the locking key, called the public key, to every visitor, and this is safe, because locking is all that key can do.

Now the problem of sending a secret across the internet becomes simple. Your browser makes up a fresh key for this conversation, puts it in the box, locks it with the website's public key, and sends the box. Anyone watching sees a locked box they cannot open. Only the website, holding the private key, opens it. From that moment both sides share one key that nobody else knows, and the rest of the conversation uses that key, because locking and unlocking with one shared key is far faster for large amounts of data.

In encryption the public key locks and the private key unlocks. In a digital signature the direction reverses: the private key signs, and the public key verifies. A digital signature detects tampering and impersonation of the sender, and provides non-repudiation, meaning the sender cannot later deny having sent the data.

A certificate authority vouches that a site is genuine.

Going Deeper

One question is worth asking before you accept that any of this is safe: what if an attacker builds a copy of your bank's website and sends you their own public key? You would lock your secret and hand it straight to them. That is what the digital certificate is for. The certificate comes from a certificate authority, a trusted third party that has checked who the site really belongs to, and the browser verifies it before anything else happens.

It is the difference between a stranger telling you their name and a stranger showing an identity card issued by an authority you already trust. When that check fails, the browser stops and shows a warning, and that warning is the one thing in this lesson you should never click past.

Egyptian Example

Open any Egyptian banking app or a government service on the Digital Egypt platform and look at the left of the address bar. Older browsers show a padlock there; Chrome replaced it in 2023 with a small tune icon, because too many people read the padlock as “this site is trustworthy” rather than “this connection is protected”. Tap it and it still says the connection is secure.

Behind that, this exact sequence just happened: the server proved its identity with a certificate, your device and the server agreed on a shared key, and everything after that moved encrypted. The padlock is not decoration, it is the visible end of the TLS handshake.

Strong login combines two or more different factors.

2. Use of Authentication in Real Services

Many services adopt multi-factor authentication, in which two or more of the three factors of authentication are combined:

When only one factor is used, an unauthorized party can gain access if that factor is broken. By combining multiple factors, even if one is broken, another can still prevent access. For example, if only a password (knowledge) is used, an unauthorized login is possible once the password is leaked. However, if a notification to a smartphone (possession) is also required, an attacker cannot log in without the device, even if the password is leaked.

The following examples of multi-factor authentication are used in various services.

FROM THE TEXTBOOK

Pause & Think

If a password is leaked, why can a second factor sent to a phone still keep the account safe?

Model answer. Because the two factors are different in kind. A password is knowledge, something you know, while the code sent to the phone is possession, something you have. An attacker who has stolen or guessed the password still does not hold the device, so the second check fails and the login is blocked. Breaking one factor is no longer enough on its own. This is also why two passwords, or a password and a secret question, do not count: both are knowledge, so one leak can expose both.

بالعربي: العاملين من نوعين مختلفين، حاجة تعرفها وحاجة معاك. اللي سرق الباسورد لسه مش ماسك موبايلك، فمش هيعدي. وعشان كده باسوردين مش بيتحسبوا مصادقة متعددة، لأنهم نفس النوع.

Egyptian Example

The one-time code you receive when you log in to a bank app or send money with InstaPay is a possession factor, and the 3-D Secure code that arrives before an online card payment goes through is the same idea. In both cases the password or card number alone is deliberately not enough, because the service assumes it might one day leak.

3. Combinations of Security Technologies

Safe communication and services are achieved not by a single technology, but by combining multiple security technologies.

For example, when purchasing a product through online shopping, these technologies are combined and used as follows:

1. When you access the site, HTTPS communication begins, and encryption prevents communication content from being read by third parties.
2. The browser checks the digital certificate to confirm that the destination is the genuine shopping site.
3. For account login, multi-factor authentication combining a password and SMS authentication prevents unauthorized logins.
4. When sending order details, a digital signature can also be used so that tampering during communication can be detected.

By combining multiple technologies in this way, various threats such as eavesdropping, tampering, impersonation, and unauthorized login can be addressed simultaneously.

Going Deeper

Notice that none of these four technologies is a smaller version of another. Encryption does nothing to tell you who you are talking to. A certificate does nothing to hide what you send. Multi-factor authentication would not notice an order being altered in transit, and a signature would not stop someone logging in with your stolen password.

Each one answers a different question: is anyone reading this, is this really who they claim to be, is this really the account holder, and has anything been changed on the way. That is why the lesson's key fact says security comes from combining technologies. When you are asked which technology solves a problem, name the threat first, then pick the tool that answers that exact threat.

Key Terms