To help explain what this question means, it is essential first to understand that while encryption can help prevent data from not being read or tampered with, authentication is what ensures you know where the data originates from. If an attacker attempts to impersonate an authorized user, the encryption fails to succeed at preventing that attacker from being able to read the encrypted message. Authentication is a vital aspect of a proper encryption protocol, as each user’s identity needs to be verified; this, however, is why only using encryption does not provide a secure form of authentication (without additional authentication methods).

Authentication can take many forms, such as confirming a user’s identity with a password or two-factor authentication; these are called factors. Factors, such as a one-time code when attempting to login to a system, enable the user to verify they are the correct authorized user, thus allowing them to access the system (or public/shared key). While using multiple forms of authentication can significantly increase security, as we all know, it can still be hacked or bypassed. If you are using a computer that isn’t connected to the Internet, protecting a file or system is quite simple; however, if the machine is accessing a Cloud application, using, for example, email encryption, the process becomes more difficult (Virtru, 2019).

Attackers can intercept or identify the public key you are using for encryption using multiple methods such as a Man-in-the-Middle (MitM) attack, where the attacker tricks the sender to using the wrong public key. Once an attacker is able to convince an authorized user to use their false public key instead of the original, they can attempt to decode it with their private key, thus allowing him to send it back to the authorized user using the initial public key (which can be altered without the realization from the authorized users).

Another method of malicious decryption would be cryptanalysis. For example, if you are using a stream cipher with a PRNG (random number generator), the encryption will utilize the generated random numbers to encrypt the message. However, if an attacker knows even a small portion of the plaintext or ciphertext bytes, especially at a specific point, he/she may be able to formulate a keystream and decrypt some or all of the encrypted message. Encryption authentication, while using digital signatures (unique codes for each authorized party), can confirm the identity of each user in the communication. While encryption, by itself, isn’t a secure means of authentication, it can be if proper authentication methods are introduced.

Trivia Question: What computer was used to break the German Enigma Cipher during World War II, and where was it located?

Alan Turing, an English pioneer in computers, known for his work in modern computer science and AI, developed some of the earliest cryptanalyst procedures. ENIGMA, a cipher machine, encrypted messages by rearranging/changing characters. While it was difficult to decrypt the encrypted messages, “The Bombe,” an electromechanical device, was created to detect the ENIGMA machine’s settings, thus allowing for decryption. The Bombe, itself, was located in Britain’s code-breaking headquarters in Bletchley park; however, several of the devices were created (CIA, 2015).

References

Virtru. (2019, July 11). Understanding Encryption and Authentication. Retrieved March 23, 2020, from https://www.virtru.com/blog/authentication-encryption/.

Stallings, W. (2017). Network Security Essentials: Applications and Standards (Sixth). Pearson.

CIA. (2015, April 10). The Enigma of Alan Turing. Retrieved March 23, 2020, from https://www.cia.gov/news-information/featured-story-archive/2015-featured-story-archive/the-enigma-of-alan-turing.html.