Introduction: The Mathematics of Trust

In Modules 1 through 3, we established a comprehensive cybersecurity framework for financial institutions. We explored the threat landscape, regulatory requirements, risk assessment methodologies, security architecture principles, network defense mechanisms, and secure remote access solutions. Each of these components relies on a common foundation: cryptography.

Cryptography is the science of securing communication and data through the use of mathematical algorithms. It is the bedrock upon which virtually all modern cybersecurity is built. In financial institutions, cryptography protects:

• Customer Data: Encryption protects personally identifiable information (PII), account numbers, and transaction histories from unauthorized access.

• Financial Transactions: Cryptographic protocols secure payment processing, wire transfers, and trading systems.

• Authentication: Digital signatures and certificates verify the identity of customers, employees, and systems.

• Compliance: Encryption and key management are required by regulations such as GLBA, GDPR, NYDFS, and PCI DSS.

Without cryptography, financial institutions could not operate securely in the digital age. Every online banking session, every ATM transaction, every wire transfer, and every stock trade relies on cryptographic algorithms to ensure confidentiality, integrity, authentication, and non-repudiation.

This lesson provides the complete mathematical foundation for cryptography in financial systems. We begin by examining the Core Cryptographic Concepts: confidentiality, integrity, authentication, and non-repudiation. We derive the mathematical formulations of each concept and analyze their security properties.

We then examine Symmetric-Key Cryptography, including the Advanced Encryption Standard (AES), its mathematical structure, and its security properties. We derive the AES Encryption Algorithm: $C=\text{AddRoundKey}(\text{ShiftRows}(\text{MixColumns}(\text{SubBytes}(P))))$. We analyze the Block Cipher Modes used in financial systems, including Electronic Codebook (ECB), Cipher Block Chaining (CBC), Counter Mode (CTR), and Galois/Counter Mode (GCM). We derive the security properties of each mode and analyze their suitability for financial applications.

We then examine Asymmetric-Key Cryptography, including the RSA algorithm and Elliptic Curve Cryptography (ECC). We derive the RSA Algorithm: C=Memod  nC=Memodn, M=Cdmod  nM=Cdmodn. We analyze the mathematical foundations of RSA, including the use of prime numbers, modular arithmetic, and the discrete logarithm problem. We compare RSA and ECC and analyze their security properties.

We also examine Cryptographic Hash Functions, including SHA-256 and SHA-3. We derive the properties of cryptographic hash functions: Pre-image Resistance, Second Pre-image Resistance, and Collision Resistance. We derive the SHA-256 Algorithm: $H=\text{Compression}(M,IV)$.

By the end, you will have a complete mathematical understanding of the core cryptographic algorithms used in financial systems and be able to analyze their security properties.

Learning Objectives

Upon completion of this lesson, you will be able to:

1. Define the core cryptographic concepts: Confidentiality, Integrity, Authentication, and Non-Repudiation.

2. Analyze the mathematical structure of the Advanced Encryption Standard (AES) : $C=\text{AddRoundKey}(\text{ShiftRows}(\text{MixColumns}(\text{SubBytes}(P))))$.

3. Derive the Block Cipher Modes used in financial systems: ECB, CBC, CTR, and GCM.

4. Analyze the RSA Algorithm: C=Memod  nC=Memodn, M=Cdmod  nM=Cdmodn, and the mathematical foundations of RSA.

5. Analyze Elliptic Curve Cryptography (ECC) and compare RSA and ECC for financial applications.

6. Analyze Cryptographic Hash Functions: $H=\text{Compression}(M,IV)$, SHA-256, and their properties.

7. Apply the security models for cryptographic algorithms to financial systems.

Part 1: Core Cryptographic Concepts

1.1 The Cryptographic Objectives

Cryptography serves four primary objectives:

Cryptography={Confidentiality,Integrity,Authentication,Non-Repudiation}Cryptography={Confidentiality,Integrity,Authentication,Non-Repudiation}​

1.2 Confidentiality

Definition: Confidentiality ensures that information is accessible only to authorized parties.

Mathematical Formulation: Let $M$ be the plaintext message, $C$ be the ciphertext, $K$ be the encryption key, and EKEK​ be the encryption function. Confidentiality is achieved when:

C=EK(M)  ⟹  P(M∣C)=P(M)C=EK​(M)⟹P(M∣C)=P(M)​

Interpretation: The ciphertext $C$ reveals no information about the plaintext $M$. An attacker with access to $C$ cannot determine $M$ without the key $K$.

Implementation: Encryption algorithms (symmetric-key encryption, asymmetric-key encryption) provide confidentiality.

1.3 Integrity

Definition: Integrity ensures that information has not been altered or tampered with.

Mathematical Formulation: Let $M$ be the original message and M′M′ be the received message. Integrity is achieved when:

M′=M  ⟹  Verification succeedsM′=M⟹Verification succeeds​

Interpretation: Any alteration of the message is detectable. An attacker cannot modify the message without detection.

Implementation: Hash functions, message authentication codes (MACs), and digital signatures provide integrity.

1.4 Authentication

Definition: Authentication verifies the identity of a party and the origin of a message.

Mathematical Formulation: Let $S$ be the sender of a message $M$. Authentication is achieved when:

Verify(M,SignatureS)=True  ⟹  S is the originVerify(M,SignatureS​)=True⟹S is the origin​

Interpretation: The recipient can verify that the message originated from the claimed sender and was not forged.

Implementation: Digital signatures, public-key certificates, and challenge-response protocols provide authentication.

1.5 Non-Repudiation

Definition: Non-Repudiation ensures that a party cannot deny having performed a particular action.

Mathematical Formulation: Let $A$ be an action performed by party $S$. Non-Repudiation is achieved when:

Proof(A)=True  ⟹  S cannot deny performing AProof(A)=True⟹S cannot deny performing A​

Interpretation: The party cannot later deny having performed the action. This is essential for financial transactions, contracts, and regulatory compliance.

Implementation: Digital signatures, audit trails, and timestamping provide non-repudiation.

Core Cryptographic Concepts (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Confidentiality                                                ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Information accessible only to authorized parties   ║  |
|  ║  Mathematical: P(M|C) = P(M)                                    ║  |
|  ║  Implementation: Encryption (AES, RSA)                          ║  |
|  ║  Example: Encrypting customer data at rest and in transit      ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Integrity                                                     ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Information has not been altered or tampered with   ║  |
|  ║  Mathematical: M' = M ⇒ Verification succeeds                  ║  |
|  ║  Implementation: Hash functions, MACs, digital signatures       ║  |
|  ║  Example: Verifying financial transaction data integrity       ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Authentication                                                ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Verifying identity and origin                     ║  |
|  ║  Mathematical: Verify(M, Signature_S) = True ⇒ S is origin     ║  |
|  ║  Implementation: Digital signatures, certificates, challenge   ║  |
|  ║  Example: Authenticating customers and employees               ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Non-Repudiation                                               ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Definition: Cannot deny having performed an action             ║  |
|  ║  Mathematical: Proof(A) = True ⇒ S cannot deny A              ║  |
|  ║  Implementation: Digital signatures, audit trails              ║  |
|  ║  Example: Financial transaction records, signed contracts      ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 2: Symmetric-Key Cryptography

2.1 The Advanced Encryption Standard (AES)

Definition: AES is a symmetric-key encryption algorithm adopted as the standard for protecting sensitive information in financial institutions.

AES={SubBytes,ShiftRows,MixColumns,AddRoundKey}AES={SubBytes,ShiftRows,MixColumns,AddRoundKey}​

Key Sizes: AES-128 (128-bit key), AES-192 (192-bit key), AES-256 (256-bit key).

Block Size: 128 bits (16 bytes).

2.2 The AES Algorithm

The AES algorithm consists of multiple rounds (10, 12, or 14 rounds depending on the key size):

C=AddRoundKey(ShiftRows(MixColumns(SubBytes(P))))NC=AddRoundKey(ShiftRows(MixColumns(SubBytes(P))))N​

Where $N$ is the number of rounds.

The Four AES Operations:

2.3 Block Cipher Modes

Block cipher modes determine how a block cipher is used to encrypt data of arbitrary length:

Block Cipher Modes={ECB,CBC,CTR,GCM}Block Cipher Modes={ECB,CBC,CTR,GCM}​

ECB Mode:

Ci=EK(Pi)Ci​=EK​(Pi​)​

CBC Mode:

Ci=EK(Pi⊕Ci−1),C0=IVCi​=EK​(Pi​⊕Ci−1​),C0​=IV​

CTR Mode:

Ci=Pi⊕EK(CTRi)Ci​=Pi​⊕EK​(CTRi​)​

GCM Mode:

Ci=Pi⊕EK(CTRi),T=Auth(A,C)Ci​=Pi​⊕EK​(CTRi​),T=Auth(A,C)​

Block Cipher Modes (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ECB Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  P₁ ──▶ E_K ──▶ C₁                                            │  │
|  │  P₂ ──▶ E_K ──▶ C₂                                            │  │
|  │  P₃ ──▶ E_K ──▶ C₃                                            │  │
|  │  Weakness: Identical plaintext blocks → identical ciphertext  │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  CBC Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  P₁ ⊕ IV ──▶ E_K ──▶ C₁                                       │  │
|  │  P₂ ⊕ C₁ ──▶ E_K ──▶ C₂                                       │  │
|  │  P₃ ⊕ C₂ ──▶ E_K ──▶ C₃                                       │  │
|  │  Strength: Identical plaintext blocks produce different       │  │
|  │  ciphertext                                                    │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  CTR Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  CTR₁ ──▶ E_K ──▶ K₁ ──▶ P₁ ⊕ K₁ ──▶ C₁                     │  │
|  │  CTR₂ ──▶ E_K ──▶ K₂ ──▶ P₂ ⊕ K₂ ──▶ C₂                     │  │
|  │  CTR₃ ──▶ E_K ──▶ K₃ ──▶ P₃ ⊕ K₃ ──▶ C₃                     │  │
|  │  Strength: Parallelizable, random access                       │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  GCM Mode                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  CTR Mode (encryption) + Authentication (tag)                 │  │
|  │  C₁, C₂, C₃, T (Authentication Tag)                            │  │
|  │  Strength: Confidentiality + Integrity                         │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 3: Asymmetric-Key Cryptography

3.1 The RSA Algorithm

Definition: RSA (Rivest-Shamir-Adleman) is a public-key cryptosystem based on the difficulty of factoring large prime numbers.

RSA={Key Generation,Encryption,Decryption}RSA={Key Generation,Encryption,Decryption}​

Key Generation:

1. Choose two large primes $p$ and $q$

2. Compute $n=p\times q$

3. Compute $\varphi (n)=(p-1)\times (q-1)$

4. Choose $e$ such that $\gcd (e,\varphi (n))=1$

5. Compute $d$ such that $e\times d\equiv 1\mathrm{mod}\varphi (n)$

Public Key: $(e,n)$

Private Key: $(d,n)$

Encryption:

C=Memod  nC=Memodn​

Decryption:

M=Cdmod  nM=Cdmodn​

3.2 The Mathematical Foundation of RSA

The security of RSA is based on the difficulty of factoring the modulus $n$ into its prime factors $p$ and $q$:

RSA Security∝Difficulty of Factoring(n)RSA Security∝Difficulty of Factoring(n)​

The RSA Assumption: Given $n=p\times q$ and $e$, it is computationally infeasible to determine $M$ from C=Memod  nC=Memodn without $d$.

3.3 Elliptic Curve Cryptography (ECC)

Definition: ECC is a public-key cryptosystem based on the algebraic structure of elliptic curves over finite fields.

The Weierstrass Equation:

y2=x3+ax+by2=x3+ax+b​

ECC Key Generation:

1. Choose an elliptic curve $E$ over a finite field

2. Choose a base point $G$ on $E$

3. Choose a private key $d$ (a large random integer)

4. Compute the public key $Q=d\times G$ (point multiplication)

ECC Security: Based on the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP):

ECC Security∝Difficulty of ECDLPECC Security∝Difficulty of ECDLP​

3.4 RSA vs. ECC for Financial Institutions

Equivalent Key Sizes:

Part 4: Cryptographic Hash Functions

4.1 The Definition

A cryptographic hash function is a deterministic algorithm that maps an arbitrary-length input to a fixed-length output.

Hash={Pre-image Resistance,Second Pre-image Resistance,Collision Resistance}Hash={Pre-image Resistance,Second Pre-image Resistance,Collision Resistance}​

Hash Function Notation:

H(M)=hH(M)=h​

4.2 Hash Function Properties

4.3 The SHA-256 Algorithm

Definition: SHA-256 is a member of the SHA-2 family of cryptographic hash functions, producing a 256-bit (32-byte) hash value.

SHA-256 Algorithm: The algorithm processes messages in 512-bit blocks and produces a 256-bit hash.

H=SHA-256(M)∈{0,1}256H=SHA-256(M)∈{0,1}256​

The SHA-256 Compression Function:

Hi=Compression(Hi−1,Mi)Hi​=Compression(Hi−1​,Mi​)​

4.4 Hash Functions in Financial Systems

Cryptographic Hash Functions (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  SHA-256 Algorithm                                                    │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  Input: M (arbitrary length)                                   │  │
|  │  1. Pad M to a multiple of 512 bits                           │  │
|  │  2. Process each 512-bit block:                               │  │
|  │     H = Compression(H, M_i)                                   │  │
|  │  3. Output H (256 bits)                                       │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Properties:                                                         │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Pre-image Resistance: Infeasible to find M given h        │  │
|  │  • Second Pre-image Resistance: Infeasible to find M₂        │  │
|  │  • Collision Resistance: Infeasible to find M₁ ≠ M₂          │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Applications in Finance:                                            │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Password Storage: SHA-256, bcrypt                          │  │
|  │  • Data Integrity: Verifying file and data integrity          │  │
|  │  • Digital Signatures: Signing with RSA or ECC               │  │
|  │  • Blockchain: Bitcoin, Ethereum transactions                 │  │
|  │  • TLS/SSL: Secure communication                              │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Summary and Bridge to Lesson 4.2

We have now completed the mathematical foundations of cryptography. You have learned:

1. Core Cryptographic Concepts: Confidentiality, Integrity, Authentication, and Non-Repudiation.

2. Symmetric-Key Cryptography: AES algorithm: C=AddRoundKey(ShiftRows(MixColumns(SubBytes(P))))NC=AddRoundKey(ShiftRows(MixColumns(SubBytes(P))))N.

3. Block Cipher Modes: ECB, CBC, CTR, and GCM.

4. Asymmetric-Key Cryptography: RSA: C=Memod  nC=Memodn, M=Cdmod  nM=Cdmodn, and ECC: y2=x3+ax+by2=x3+ax+b.

5. Cryptographic Hash Functions: SHA-256: $H=\text{SHA-256}(M)$, and the properties of cryptographic hash functions.

In Lesson 4.2, we will explore Key Management and Public Key Infrastructure (PKI) in Financial Institutions, analyzing how cryptographic keys are generated, stored, distributed, and revoked.