Cryptography vs Security

Question

This may sound a little bit of basic but here it goes…

Which of the following is correct?

1. “Cryptography is under the security field”, or
2. “Security is under the cryptography field?”

Cryptography is all about encryption and decryption. Encryption/Decryption requires a key. Isn't security the same? Security also depends on key/password, to keep data secure. I can feel that they are co-related but I'm not clear about the differences. Can anyone clear this out?

EDIT: With the word "under" I meant pure dependency, and "Security" hints at Information Security.

Answer 1

The correct answer would be:

1 . “Cryptography is under the security field”.

Let me try to explain it a bit…

Cryptography

Modern cryptography concerns itself with 4 objectives:

1. Confidentiality: the information cannot be understood by anyone for whom it was unintended.
2. Integrity: the information cannot be altered in storage or transit between sender and intended receiver without the alteration being detected.
3. Non-repudiation: the creator/sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information.
4. Authentication: the sender and receiver can confirm each other’s identity and the origin/destination of the information.

Information Security

Now, if you look at information security (what you simply call “security”), you’ll notice that – besides the four points mentioned above – there’s a whole universe of other security-related things that information security handles. To name just a few examples of what information security additionally covers (besides cryptography):

• risk management,
• access control,
• security classification of information,
• business continuity,
• disaster recovery planning,
• laws and regulations,
• etc.

Nota Bene

In the end, this might also help you understand why StackExchange has a Security.SE – which covers information security in general, and a Crypto.SE – which explicitly focuses on cryptographic details like algorithm design, protocol analysis, etc.

---

EDIT:
More of an aside, but it may help understand things even better… I just noticed that Wikipedia has a nice Contents-listing in their InfoSec article, from which you can see how Cryptography fits into Information Security as a sub-category (6.5).

Answer 2

Cryptography is just one way towards security. It can solve some issues of security but not all of them. Careful coding for instance has nothing to do with cryptography. Appropriate memory allocation is not correlated with crypto but it is an aspect of security. Cryptography can ensure confidentiality, integrity, secure computations etc at some level.

Answer 3

I'm going to differ from everybody else, and say: Neither.

There is definite overlap, and mutual reliance. However, strictly speaking:

Cryptography is a part of Math.
Security relies on Cryptography, to some extent.

Or rather, Security would require using Cryptography to protect certain properties, as defined by Cryptography.

There is also quite a bit of overlap, but I will avoid being overly pedantic.

In particular, when someone is talking about "Cryptography being a part of Security [sic]", they are usually referring to the implementation, i.e. usage, of cryptography blocks to provide security requirements.

Answer 4

Cryptography is part of security. Cryptography can be used to create a secure system. But you can also create a secure system utilizing, for instance, a physical door with a lock.

Cryptographic research is usually thought of as part of security as well, although the results may not always be applicable for creating secure systems of course.

Answer 5

I think this question has no real answer as it stands and is even hard to answer if we would clearly define what we mean by "cryptography" and what we mean by "security" (Below I assume that you mean "information security" by security, because security is even harder to define).

Moreover, your definition of cryptography is quite outdated. That cryptography is all about encryption and decryption is the classic view of cryptography (lets say until the early 70ies).

Starting with the invention of public key cryptography and then when starting inventing tools what we call provable (reductionist) security today or concepts such as interactive proof systems (including zero-knowledge proofs), cryptography got far broader than just being concerned with the designing encryption schemes.

Today cryptography is a broad field (I think one could safely argue that it has grown to a science in its own right) relying on mathematics, (theoretical) computer science (complexity theory), engineering sciences such as computer engineering and covers many different fields going from purely theoretical cryptography to cryptographic engineering to purely applied cryptography. To given you an idea, theoretical cryptography covers the formal study of cryptographic primitives such as their security and their relationships, cryptographic engineering covers the efficient implementation of cryptographic algorithms in hard- and software as well as attacking such implementations (side-channels, etc.) and applied cryptography can be seen as a very broad field mainly devoted to bringing stuff into (complex) real world applications (i.e., designing protocols for secure communication, secure transactions, secure computation, digital cash, etc.). However, often these subfields cannot even be really kept apart.

Now @e-sushi in his answer already gave some ideas what information security is and how broad this field is. Thereby, you should also have in mind that although this field is very applied there are also many quite theoretical fields in information security such as information flow theory, access control theory, or code or program analysis (just to name a few random examples) which by themselves use tools from various different fields such as mathematics or computer science (e.g., from machine learning). Some of the subfields of information security use cryptography in the some way and these things are much related to purely applied cryptography, but there are also many fields in information security that are not related to cryptography.

It is true that information security uses concepts from (applied) cryptography to achieve some of its goals and that security is the ultimate justification to do cryptographic research. Anyways, I would rather say (and that is my personal opinion) it is really hard to put one of these fields as a subfield of the other and none of your statements is fully correct (but that is my view). When it comes to science, usually people do not like it to be treated as being a (small) subfield of some other discipline but like it to be considered as a discipline in its own right.

But if you want to have some "second opinion" from some other guys (such as the ACM), you could take a look at the ACM classification (1998) or the ACM classification (2012) where in the 1998 version the term "cryptography" does not really appear ("cryptographic controls" is under "Security and Protection") and in the 2012 version cryptoraphy can be found in the classes "Theory of computation" and "Security and privacy" (there are some minor appearances also in other classes). Not sure if that helps much ;)

Answer 6

Cryptography and Security are two different means to the same end. Which one (or balance of the two) you choose depends on your needs.

The basic principle is we don't want unauthorized people getting the information.

We can go the low security route and apply strong encryption. The assumption here is we cannot prevent unauthorized people from seeing the raw data, but we do not care if they do see it as it is meaningless. Common examples are online banking and any radio communication like your mobile phone.

We can go the high security route and forget about encryption altogether. Put up physical barriers to access. The assumption here would be that anyone who gets past the barriers has access. A well-known example here is the Nuclear Briefcase that follows the US and Russian Presidents around everywhere - it's protected by a LOT of guns and probably has a self-destruct device. If WWIII starts he won't have time to sit down with a pencil and one-time pads so encryption isn't practical.

A hybrid would be my bank allowing easy login from my home computer. If I use a new one, I get asked a lot more questions. The connection to my bank is encrypted, the security is provided by the locks on my doors and windows.

So, to refer back to the original question, the terms are inter-related. Cryptography is an important, but optional part of information security. Information security frequently depends on cryptography, but it's not required to.