# Cryptography vs Security

This may sound a little bit of basic but here it goes…

Which of the following is correct?

1. “Cryptography is under the security field”, or
2. “Security is under the cryptography field?”

Cryptography is all about encryption and decryption. Encryption/Decryption requires a key. Isn't security the same? Security also depends on key/password, to keep data secure. I can feel that they are co-related but I'm not clear about the differences. Can anyone clear this out?

EDIT: With the word "under" I meant pure dependency, and "Security" hints at Information Security.

1 . “Cryptography is under the security field”.

Let me try to explain it a bit…

## Cryptography

Modern cryptography concerns itself with 4 objectives:

1. Confidentiality: the information cannot be understood by anyone for whom it was unintended.
2. Integrity: the information cannot be altered in storage or transit between sender and intended receiver without the alteration being detected.
3. Non-repudiation: the creator/sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information.
4. Authentication: the sender and receiver can confirm each other’s identity and the origin/destination of the information.

## Information Security

Now, if you look at information security (what you simply call “security”), you’ll notice that – besides the four points mentioned above – there’s a whole universe of other security-related things that information security handles. To name just a few examples of what information security additionally covers (besides cryptography):

• risk management,
• access control,
• security classification of information,
• disaster recovery planning,
• laws and regulations,
• etc.

## Nota Bene

In the end, this might also help you understand why StackExchange has a Security.SE – which covers information security in general, and a Crypto.SE – which explicitly focuses on cryptographic details like algorithm design, protocol analysis, etc.

EDIT:
More of an aside, but it may help understand things even better… I just noticed that Wikipedia has a nice Contents-listing in their InfoSec article, from which you can see how Cryptography fits into Information Security as a sub-category (6.5).

Cryptography is just one way towards security. It can solve some issues of security but not all of them. Careful coding for instance has nothing to do with cryptography. Appropriate memory allocation is not correlated with crypto but it is an aspect of security. Cryptography can ensure confidentiality, integrity, secure computations etc at some level.

• your answer is good. Now I'm clear. So, only certain properties of security are applicable to cryptography. – Giliweed Aug 19 '14 at 16:49

I'm going to differ from everybody else, and say: Neither.

There is definite overlap, and mutual reliance. However, strictly speaking:

Cryptography is a part of Math.
Security relies on Cryptography, to some extent.

Or rather, Security would require using Cryptography to protect certain properties, as defined by Cryptography.

There is also quite a bit of overlap, but I will avoid being overly pedantic.

In particular, when someone is talking about "Cryptography being a part of Security [sic]", they are usually referring to the implementation, i.e. usage, of cryptography blocks to provide security requirements.

• I think it's rather fallacious to pretend that cryptography isn't a subset of all things security-related, just because cryptography is also a subset of math. Besides, isn't everything a part of math when you dig down deep enough? Anyway, when choosing a category such as purpose (which seems sensible given the way the asker above phrased his or her question), cryptography is very much a complete subset of security given that all four objectives of cryptography as mentioned above by e-sushi are geared toward satisfying certain aspects of security. – Will Aug 19 '14 at 23:57
• I guess the reason why we differ is, that – strictly speaking – modern cryptography intersects the disciplines of mathematics, computer science, and electrical engineering. Therefore, most of us would never limit things by writing Cryptography is a part of Math. Also, statements like Security relies on Cryptography, to some extent. ignore the risks of relying on cryptography, as well as the fact that security can rely on many things… which are defined by individual InfoSec Assessments & Evaluations. (E.g.: security in disaster recovery can be as simple as having a backup when a HD dies.) – e-sushi Aug 20 '14 at 0:16
• I think this is actually the most correct, although I'm not sure this question is objective enough. From the point of view of (information) security, cryptography is a tool, just like e.g. combinatorics is a tool from the PoV of cryptography. We don't say combinatorics is "under" cryptography nor should we say cryptography is "under" security. – otus Aug 20 '14 at 6:54
• all these comments are making me confused again! What I meant by the word "under" is dependency. If a field2 depends on another field1 then field2 is considered as a sub-field of field1--- simple! – Giliweed Aug 20 '14 at 13:38
• @otus, seriously? you really think cryptography is a tool? I'm not sure what "combinatorics" are but surely you can't say what ever comes from Cryptography (e.g.AES) or itself a tool! To me cryptography is vast field of encryption and decryption (spreading its branches to mathematics, computer science etc ---which I don't deny). Without encryption/decryption the word "crypto" loses its pride. If I'm wrong you are welcome to clear my definitions. Because I really want to have good basic knowledge. – Giliweed Aug 20 '14 at 14:45

Cryptography is part of security. Cryptography can be used to create a secure system. But you can also create a secure system utilizing, for instance, a physical door with a lock.

Cryptographic research is usually thought of as part of security as well, although the results may not always be applicable for creating secure systems of course.

• good answer, so this clears that cryptography is under security field. – Giliweed Aug 19 '14 at 16:50

I think this question has no real answer as it stands and is even hard to answer if we would clearly define what we mean by "cryptography" and what we mean by "security" (Below I assume that you mean "information security" by security, because security is even harder to define).

Moreover, your definition of cryptography is quite outdated. That cryptography is all about encryption and decryption is the classic view of cryptography (lets say until the early 70ies).

Starting with the invention of public key cryptography and then when starting inventing tools what we call provable (reductionist) security today or concepts such as interactive proof systems (including zero-knowledge proofs), cryptography got far broader than just being concerned with the designing encryption schemes.

Today cryptography is a broad field (I think one could safely argue that it has grown to a science in its own right) relying on mathematics, (theoretical) computer science (complexity theory), engineering sciences such as computer engineering and covers many different fields going from purely theoretical cryptography to cryptographic engineering to purely applied cryptography. To given you an idea, theoretical cryptography covers the formal study of cryptographic primitives such as their security and their relationships, cryptographic engineering covers the efficient implementation of cryptographic algorithms in hard- and software as well as attacking such implementations (side-channels, etc.) and applied cryptography can be seen as a very broad field mainly devoted to bringing stuff into (complex) real world applications (i.e., designing protocols for secure communication, secure transactions, secure computation, digital cash, etc.). However, often these subfields cannot even be really kept apart.

Now @e-sushi in his answer already gave some ideas what information security is and how broad this field is. Thereby, you should also have in mind that although this field is very applied there are also many quite theoretical fields in information security such as information flow theory, access control theory, or code or program analysis (just to name a few random examples) which by themselves use tools from various different fields such as mathematics or computer science (e.g., from machine learning). Some of the subfields of information security use cryptography in the some way and these things are much related to purely applied cryptography, but there are also many fields in information security that are not related to cryptography.

It is true that information security uses concepts from (applied) cryptography to achieve some of its goals and that security is the ultimate justification to do cryptographic research. Anyways, I would rather say (and that is my personal opinion) it is really hard to put one of these fields as a subfield of the other and none of your statements is fully correct (but that is my view). When it comes to science, usually people do not like it to be treated as being a (small) subfield of some other discipline but like it to be considered as a discipline in its own right.

But if you want to have some "second opinion" from some other guys (such as the ACM), you could take a look at the ACM classification (1998) or the ACM classification (2012) where in the 1998 version the term "cryptography" does not really appear ("cryptographic controls" is under "Security and Protection") and in the 2012 version cryptoraphy can be found in the classes "Theory of computation" and "Security and privacy" (there are some minor appearances also in other classes). Not sure if that helps much ;)

• So, your telling, (if I understood correctly) each of them are independent fields and no one in under no one and no one is a sub-category of the other's, right? – Giliweed Aug 20 '14 at 12:51
• after reading and accepting E-sushi's answer , your one is making me a little confused..... Umm , I'm not sure how to explain it... – Giliweed Aug 20 '14 at 12:53
• @Giliweed They are not independent in the sense that they have nothing to do with each other, but it does not make sense to put one as a subfield of the other one. It is true that information security uses things that cryptography produces but that does not make cryptography a subfield of information security. – DrLecter Aug 20 '14 at 12:54
• "I work in a place where whatever I produce boss takes it away and uses for boss's purpose, my work makes boss more powerful, there is no way I can use my product for myself, even if I try boss gets involved somehow! So, I can never say I am independent. I am dependent because without boss I don't exist. This proves that to keep my existence I must work under boss, So I'm under boss" --- Just replace "I/my" with Cryptography and "boss" with security. What do you see? :) – Giliweed Aug 20 '14 at 13:22
• There are many cryptographic algorithms that does not provide as much as security as AES. Does people remember their existence? Does people use them? No. So what ever cryptography produces it must make data/network secure. So Cryptography depends on security to keep its existence. And all who(C) depends on whom(S) are considered as their sub-category/sub-field. --- how are you gonna disagree with this? – Giliweed Aug 20 '14 at 13:25

Cryptography and Security are two different means to the same end. Which one (or balance of the two) you choose depends on your needs.

The basic principle is we don't want unauthorized people getting the information.

We can go the low security route and apply strong encryption. The assumption here is we cannot prevent unauthorized people from seeing the raw data, but we do not care if they do see it as it is meaningless. Common examples are online banking and any radio communication like your mobile phone.

We can go the high security route and forget about encryption altogether. Put up physical barriers to access. The assumption here would be that anyone who gets past the barriers has access. A well-known example here is the Nuclear Briefcase that follows the US and Russian Presidents around everywhere - it's protected by a LOT of guns and probably has a self-destruct device. If WWIII starts he won't have time to sit down with a pencil and one-time pads so encryption isn't practical.

A hybrid would be my bank allowing easy login from my home computer. If I use a new one, I get asked a lot more questions. The connection to my bank is encrypted, the security is provided by the locks on my doors and windows.

So, to refer back to the original question, the terms are inter-related. Cryptography is an important, but optional part of information security. Information security frequently depends on cryptography, but it's not required to.