LESSON 4.1: Mathematical Foundations of Cryptography – Algorithms, Protocols, and Security Models

Introduction: The Mathematics of Trust

In Modules 1 through 3, we established a comprehensive cybersecurity framework for financial institutions. We explored the threat landscape, regulatory requirements, risk assessment methodologies, security architecture principles, network defense mechanisms, and secure remote access solutions. Each of these components relies on a common foundation: cryptography.

Cryptography is the science of securing communication and data through the use of mathematical algorithms. It is the bedrock upon which virtually all modern cybersecurity is built. In financial institutions, cryptography protects:

Customer Data: Encryption protects personally identifiable information (PII), account numbers, and transaction histories from unauthorized access.
Financial Transactions: Cryptographic protocols secure payment processing, wire transfers, and trading systems.
Authentication: Digital signatures and certificates verify the identity of customers, employees, and systems.
Compliance: Encryption and key management are required by regulations such as GLBA, GDPR, NYDFS, and PCI DSS.

Without cryptography, financial institutions could not operate securely in the digital age. Every online banking session, every ATM transaction, every wire transfer, and every stock trade relies on cryptographic algorithms to ensure confidentiality, integrity, authentication, and non-repudiation.

This lesson provides the complete mathematical foundation for cryptography in financial systems. We begin by examining the Core Cryptographic Concepts: confidentiality, integrity, authentication, and non-repudiation. We derive the mathematical formulations of each concept and analyze their security properties.

We then examine Symmetric-Key Cryptography, including the Advanced Encryption Standard (AES), its mathematical structure, and its security properties. We derive the AES Encryption Algorithm: $C = AddRoundKey (ShiftRows (MixColumns (SubBytes (P))))$ . We analyze the Block Cipher Modes used in financial systems, including Electronic Codebook (ECB), Cipher Block Chaining (CBC), Counter Mode (CTR), and Galois/Counter Mode (GCM). We derive the security properties of each mode and analyze their suitability for financial applications.

We then examine Asymmetric-Key Cryptography, including the RSA algorithm and Elliptic Curve Cryptography (ECC). We derive the RSA Algorithm: $C = M^{e} mod n$ , $M = C^{d} mod n$ . We analyze the mathematical foundations of RSA, including the use of prime numbers, modular arithmetic, and the discrete logarithm problem. We compare RSA and ECC and analyze their security properties.

We also examine Cryptographic Hash Functions, including SHA-256 and SHA-3. We derive the properties of cryptographic hash functions: Pre-image Resistance, Second Pre-image Resistance, and Collision Resistance. We derive the SHA-256 Algorithm: $H = Compression (M, I V)$ .

By the end, you will have a complete mathematical understanding of the core cryptographic algorithms used in financial systems and be able to analyze their security properties.

Learning Objectives

Upon completion of this lesson, you will be able to:

Define the core cryptographic concepts: Confidentiality, Integrity, Authentication, and Non-Repudiation.
Analyze the mathematical structure of the Advanced Encryption Standard (AES) : $C = AddRoundKey (ShiftRows (MixColumns (SubBytes (P))))$ .
Derive the Block Cipher Modes used in financial systems: ECB, CBC, CTR, and GCM.
Analyze the RSA Algorithm: $C = M^{e} mod n$ , $M = C^{d} mod n$ , and the mathematical foundations of RSA.
Analyze Elliptic Curve Cryptography (ECC) and compare RSA and ECC for financial applications.
Analyze Cryptographic Hash Functions: $H = Compression (M, I V)$ , SHA-256, and their properties.
Apply the security models for cryptographic algorithms to financial systems.

Part 1: Core Cryptographic Concepts

1.1 The Cryptographic Objectives

Cryptography serves four primary objectives:

$Cryptography = {Confidentiality, Integrity, Authentication, Non-Repudiation}$

1.2 Confidentiality

Definition: Confidentiality ensures that information is accessible only to authorized parties.

Mathematical Formulation: Let $M$ be the plaintext message, $C$ be the ciphertext, $K$ be the encryption key, and $E_{K}$ be the encryption function. Confidentiality is achieved when:

$C = E^{K} (M) ⟹ P (M ∣ C) = P (M)$

Interpretation: The ciphertext $C$ reveals no information about the plaintext $M$ . An attacker with access to $C$ cannot determine $M$ without the key $K$ .

Implementation: Encryption algorithms (symmetric-key encryption, asymmetric-key encryption) provide confidentiality.

1.3 Integrity

Definition: Integrity ensures that information has not been altered or tampered with.

Mathematical Formulation: Let $M$ be the original message and $M^{'}$ be the received message. Integrity is achieved when:

$M^{'} = M ⟹ Verification succeeds$

Interpretation: Any alteration of the message is detectable. An attacker cannot modify the message without detection.

Implementation: Hash functions, message authentication codes (MACs), and digital signatures provide integrity.

1.4 Authentication

Definition: Authentication verifies the identity of a party and the origin of a message.

Mathematical Formulation: Let $S$ be the sender of a message $M$ . Authentication is achieved when:

$Verify (M, Signature^{S}) = True ⟹ S is the origin$

Interpretation: The recipient can verify that the message originated from the claimed sender and was not forged.

Implementation: Digital signatures, public-key certificates, and challenge-response protocols provide authentication.

1.5 Non-Repudiation

Definition: Non-Repudiation ensures that a party cannot deny having performed a particular action.

Mathematical Formulation: Let $A$ be an action performed by party $S$ . Non-Repudiation is achieved when:

$Proof (A) = True ⟹ S cannot deny performing A$

Interpretation: The party cannot later deny having performed the action. This is essential for financial transactions, contracts, and regulatory compliance.

Implementation: Digital signatures, audit trails, and timestamping provide non-repudiation.

Core Cryptographic Concepts (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Confidentiality                                                ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Information accessible only to authorized parties   ║  |
|  ║  Mathematical: P(M|C) = P(M)                                    ║  |
|  ║  Implementation: Encryption (AES, RSA)                          ║  |
|  ║  Example: Encrypting customer data at rest and in transit      ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Integrity                                                     ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Information has not been altered or tampered with   ║  |
|  ║  Mathematical: M' = M ⇒ Verification succeeds                  ║  |
|  ║  Implementation: Hash functions, MACs, digital signatures       ║  |
|  ║  Example: Verifying financial transaction data integrity       ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Authentication                                                ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Verifying identity and origin                     ║  |
|  ║  Mathematical: Verify(M, Signature_S) = True ⇒ S is origin     ║  |
|  ║  Implementation: Digital signatures, certificates, challenge   ║  |
|  ║  Example: Authenticating customers and employees               ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Non-Repudiation                                               ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Cannot deny having performed an action             ║  |
|  ║  Mathematical: Proof(A) = True ⇒ S cannot deny A              ║  |
|  ║  Implementation: Digital signatures, audit trails              ║  |
|  ║  Example: Financial transaction records, signed contracts      ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 2: Symmetric-Key Cryptography

2.1 The Advanced Encryption Standard (AES)

Definition: AES is a symmetric-key encryption algorithm adopted as the standard for protecting sensitive information in financial institutions.

$AES = {SubBytes, ShiftRows, MixColumns, AddRoundKey}$

Key Sizes: AES-128 (128-bit key), AES-192 (192-bit key), AES-256 (256-bit key).

Block Size: 128 bits (16 bytes).

2.2 The AES Algorithm

The AES algorithm consists of multiple rounds (10, 12, or 14 rounds depending on the key size):

$C = AddRoundKey (ShiftRows (MixColumns (SubBytes (P))))^{N}$

Where $N$ is the number of rounds.

The Four AES Operations:

Operation	Description	Mathematical Formulation
SubBytes	Nonlinear substitution using S-box	$S (a_{i, j})$
ShiftRows	Cyclic shift of each row	$b_{i, j} = a_{i, (j + s hi f t (i)) mod 4}$
MixColumns	Linear mixing of each column	$b_{j} = Mix (a_{j})$
AddRoundKey	XOR with round key	$b = a \oplus RoundKey$

2.3 Block Cipher Modes

Block cipher modes determine how a block cipher is used to encrypt data of arbitrary length:

$Block Cipher Modes = {ECB, CBC, CTR, GCM}$

Mode	Description	Security Properties	Financial Use Case
ECB (Electronic Codebook)	Each block encrypted independently	Weak: Identical plaintext blocks produce identical ciphertext	Not recommended for financial data
CBC (Cipher Block Chaining)	Each block XORed with previous ciphertext	Strong: Provides confidentiality	Data encryption at rest
CTR (Counter Mode)	Uses counter as input to the cipher	Strong: Parallelizable, random access	High-performance encryption
GCM (Galois/Counter Mode)	CTR mode with authentication	Strong: Provides confidentiality + integrity	TLS, IPSec, authenticated encryption

ECB Mode:

$C^{i} = E^{K} (P^{i})$

CBC Mode:

$C^{i} = E^{K} (P^{i} \oplus C^{i - 1}), C^{0} = I V$

CTR Mode:

$C^{i} = P^{i} \oplus E^{K} (CT R^{i})$

GCM Mode:

$C^{i} = P^{i} \oplus E^{K} (CT R^{i}), T = Auth (A, C)$

Block Cipher Modes (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ECB Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  P₁ ──▶ E_K ──▶ C₁                                            │  │
|  │  P₂ ──▶ E_K ──▶ C₂                                            │  │
|  │  P₃ ──▶ E_K ──▶ C₃                                            │  │
|  │  Weakness: Identical plaintext blocks → identical ciphertext  │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  CBC Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  P₁ ⊕ IV ──▶ E_K ──▶ C₁                                       │  │
|  │  P₂ ⊕ C₁ ──▶ E_K ──▶ C₂                                       │  │
|  │  P₃ ⊕ C₂ ──▶ E_K ──▶ C₃                                       │  │
|  │  Strength: Identical plaintext blocks produce different       │  │
|  │  ciphertext                                                    │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  CTR Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  CTR₁ ──▶ E_K ──▶ K₁ ──▶ P₁ ⊕ K₁ ──▶ C₁                     │  │
|  │  CTR₂ ──▶ E_K ──▶ K₂ ──▶ P₂ ⊕ K₂ ──▶ C₂                     │  │
|  │  CTR₃ ──▶ E_K ──▶ K₃ ──▶ P₃ ⊕ K₃ ──▶ C₃                     │  │
|  │  Strength: Parallelizable, random access                       │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  GCM Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  CTR Mode (encryption) + Authentication (tag)                 │  │
|  │  C₁, C₂, C₃, T (Authentication Tag)                            │  │
|  │  Strength: Confidentiality + Integrity                         │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 3: Asymmetric-Key Cryptography

3.1 The RSA Algorithm

Definition: RSA (Rivest-Shamir-Adleman) is a public-key cryptosystem based on the difficulty of factoring large prime numbers.

$RSA = {Key Generation, Encryption, Decryption}$

Key Generation:

Choose two large primes $p$ and $q$
Compute $n = p \times q$
Compute $ϕ (n) = (p - 1) \times (q - 1)$
Choose $e$ such that $gcd (e, ϕ (n)) = 1$
Compute $d$ such that $e \times d \equiv 1 mod ϕ (n)$

Public Key: $(e, n)$

Private Key: $(d, n)$

Encryption:

$C = M^{e} mod n$

Decryption:

$M = C^{d} mod n$

3.2 The Mathematical Foundation of RSA

The security of RSA is based on the difficulty of factoring the modulus $n$ into its prime factors $p$ and $q$ :

$RSA Security \propto Difficulty of Factoring (n)$

The RSA Assumption: Given $n = p \times q$ and $e$ , it is computationally infeasible to determine $M$ from $C = M^{e} mod n$ without $d$ .

3.3 Elliptic Curve Cryptography (ECC)

Definition: ECC is a public-key cryptosystem based on the algebraic structure of elliptic curves over finite fields.

The Weierstrass Equation:

$y^{2} = x^{3} + a x + b$

ECC Key Generation:

Choose an elliptic curve $E$ over a finite field
Choose a base point $G$ on $E$
Choose a private key $d$ (a large random integer)
Compute the public key $Q = d \times G$ (point multiplication)

ECC Security: Based on the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP):

$ECC Security \propto Difficulty of ECDLP$

3.4 RSA vs. ECC for Financial Institutions

Aspect	RSA	ECC
Key Size	Larger (2048-4096 bits)	Smaller (256-512 bits)
Performance	Slower	Faster
Security Level	Based on integer factoring	Based on ECDLP
Implementation	Widely implemented	Growing adoption
Financial Use Case	Legacy systems, certificates	Modern systems, mobile devices

Equivalent Key Sizes:

RSA Key Size	ECC Key Size	Security Level
1024 bits	160 bits	80 bits
2048 bits	224 bits	112 bits
3072 bits	256 bits	128 bits
7680 bits	384 bits	192 bits
15360 bits	512 bits	256 bits

Part 4: Cryptographic Hash Functions

4.1 The Definition

A cryptographic hash function is a deterministic algorithm that maps an arbitrary-length input to a fixed-length output.

$Hash = {Pre-image Resistance, Second Pre-image Resistance, Collision Resistance}$

Hash Function Notation:

$H (M) = h$

4.2 Hash Function Properties

Property	Definition	Mathematical Formulation
Pre-image Resistance	Given $h$ , it is infeasible to find $M$ such that $H (M) = h$	$∄ M : H (M) = h$
Second Pre-image Resistance	Given $M_{1}$ , it is infeasible to find $M_{2}$ such that $H (M_{1}) = H (M_{2})$	$∄ M_{2} \neq = M_{1} : H (M_{2}) = H (M_{1})$
Collision Resistance	It is infeasible to find $M_{1} \neq = M_{2}$ such that $H (M_{1}) = H (M_{2})$	$∄ M_{1} \neq = M_{2} : H (M_{1}) = H (M_{2})$

4.3 The SHA-256 Algorithm

Definition: SHA-256 is a member of the SHA-2 family of cryptographic hash functions, producing a 256-bit (32-byte) hash value.

SHA-256 Algorithm: The algorithm processes messages in 512-bit blocks and produces a 256-bit hash.

$H = SHA-256 (M) \in {0, 1}^{256}$

The SHA-256 Compression Function:

$H^{i} = Compression (H^{i - 1}, M^{i})$

4.4 Hash Functions in Financial Systems

Use Case	Hash Function	Purpose
Password Storage	SHA-256, bcrypt	Secure storage of passwords
Data Integrity	SHA-256, SHA-3	Verifying file and data integrity
Digital Signatures	SHA-256	Signing with RSA or ECC
Blockchain	SHA-256	Bitcoin, Ethereum transactions
TLS/SSL	SHA-256, SHA-384	Secure communication

Cryptographic Hash Functions (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  SHA-256 Algorithm                                                    │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  Input: M (arbitrary length)                                   │  │
|  │  1. Pad M to a multiple of 512 bits                           │  │
|  │  2. Process each 512-bit block:                               │  │
|  │     H = Compression(H, M_i)                                   │  │
|  │  3. Output H (256 bits)                                       │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Properties:                                                         │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Pre-image Resistance: Infeasible to find M given h        │  │
|  │  • Second Pre-image Resistance: Infeasible to find M₂        │  │
|  │  • Collision Resistance: Infeasible to find M₁ ≠ M₂          │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Applications in Finance:                                            │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Password Storage: SHA-256, bcrypt                          │  │
|  │  • Data Integrity: Verifying file and data integrity          │  │
|  │  • Digital Signatures: Signing with RSA or ECC               │  │
|  │  • Blockchain: Bitcoin, Ethereum transactions                 │  │
|  │  • TLS/SSL: Secure communication                              │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Summary and Bridge to Lesson 4.2

We have now completed the mathematical foundations of cryptography. You have learned:

Core Cryptographic Concepts: Confidentiality, Integrity, Authentication, and Non-Repudiation.
Symmetric-Key Cryptography: AES algorithm: $C = AddRoundKey (ShiftRows (MixColumns (SubBytes (P))))^{N}$ .
Block Cipher Modes: ECB, CBC, CTR, and GCM.
Asymmetric-Key Cryptography: RSA: $C = M^{e} mod n$ , $M = C^{d} mod n$ , and ECC: $y^{2} = x^{3} + a x + b$ .
Cryptographic Hash Functions: SHA-256: $H = SHA-256 (M)$ , and the properties of cryptographic hash functions.

In Lesson 4.2, we will explore Key Management and Public Key Infrastructure (PKI) in Financial Institutions, analyzing how cryptographic keys are generated, stored, distributed, and revoked.

Certificate in Cybersecurity for Financial Institutions LESSON 4.1: Mathematical Foundations of Cryptography – Algorithms, Protocols, and Security Models

Certificate in Cybersecurity for Financial Institutions