Cryptography & Digital Payments: Security, Bitcoin, Signatures & Systems

TAKEAWAYS:

• Cryptography protects data via encryption (symmetric/asymmetric) and digital signatures (non-repudiation).
• Bitcoin uses blockchain and cryptography for decentralized, secure transactions without banks.
• Digital payments (ACH, e-wallets) replace cash but face fraud risks like phishing and malware.
• Nepal’s eSewa/Khalti use cryptography to validate transactions and prevent fraud.
• Digital signatures bind identity to data using public-key cryptography.
• Security threats (ransomware, MITM) require layered defenses (firewalls, encryption).

1. Introduction to Cryptography

Cryptography is the science of securing information by converting it into an unreadable format (ciphertext) that only authorized parties can decrypt. It is the backbone of digital payments, secure communications, and blockchain technologies.

1.1 Classification of Cryptography

Cryptography is broadly classified into two types:

1.2 Symmetric Cryptography

• Definition: Uses a single key for both encryption and decryption.
• Examples: Advanced Encryption Standard (AES), Data Encryption Standard (DES).
• Advantages:
  • Faster processing.
  • Lower computational overhead.
• Disadvantages:
  • Key distribution is challenging (how to securely share the key?).
  • Vulnerable to brute-force attacks if the key is weak.

1.3 Asymmetric Cryptography

• Definition: Uses a pair of keys—public key (shared) and private key (secret).
• Examples: RSA (Rivest-Shamir-Adleman), Elliptic Curve Cryptography (ECC).
• Advantages:
  • Solves the key distribution problem (public key can be shared openly).
  • Enables digital signatures and secure key exchange (e.g., Diffie-Hellman).
• Disadvantages:
  • Slower than symmetric encryption.
  • More complex to implement.

| A sends encrypted message to B using B’s public key. B decrypts using their private key. |

2. Digital Signatures

A digital signature is a cryptographic technique that ensures:

• Authenticity: The message is from the claimed sender.
• Integrity: The message has not been altered.
• Non-repudiation: The sender cannot deny sending the message.

How Digital Signatures Work

1. Hashing: The message is hashed into a fixed-size string (e.g., SHA-256).
2. Signing: The sender encrypts the hash with their private key, creating a digital signature.
3. Verification: The recipient decrypts the signature with the sender’s public key and compares it to the hash of the received message.

sequenceDiagram
    participant A as Sender
    participant B as Recipient
    participant CA as Certificate Authority

    A->>CA: Registers public key
    CA-->>A: Issues digital certificate
    A->>B: Sends message + digital signature
    B->>CA: Verifies sender’s public key
    B->>B: Hashes received message
    B->>B: Decrypts signature with public key
    B->>B: Compares hashes
    Note right of B: If hashes match, message is authentic.

Requirements for Digital Signatures

1. Non-repudiation: The sender cannot deny signing.
2. Integrity: The message cannot be altered without detection.
3. Authentication: The signature must be verifiable by the recipient.
4. Immutable: The signature must be tied to the original message.

| Step-by-step flow of hashing, signing, and verification. |

3. Digital Payment Systems

Digital payments replace cash with electronic transactions. Nepal’s shift to cashless payments (eSewa, Khalti, Ncell Money) reflects global trends like ACH (Automated Clearing House) and e-wallets.

3.1 ACH (Automated Clearing House)

• Definition: A batch-based electronic funds transfer system for domestic payments.
• How it works:
  1. Sender initiates a payment (e.g., salary transfer).
  2. Bank processes the transaction in batches (e.g., nightly).
  3. Funds are debited from the sender’s account and credited to the recipient’s.
• Example in Nepal: Nabil Bank’s Nabil Online uses ACH for interbank transfers.

3.2 E-Wallets (Mobile Payments)

• Definition: Digital wallets (eSewa, Khalti, MobiCash) store payment info and enable quick transactions.
• How it works:
  1. User links bank account/credit card to the wallet.
  2. For payments, the wallet generates a one-time password (OTP) or uses biometrics.
  3. Transaction is authenticated via cryptography (e.g., HMAC for integrity).
• Advantages:
  • Convenient for small transactions (e.g., Pathao rides, Daraz orders).
  • Reduces cash handling and fraud risks.
• Disadvantages:
  • Vulnerable to phishing and malware (e.g., fake apps stealing credentials).
  • Requires internet connectivity.

Mermaid Table: Comparison of Payment Systems

4. Bitcoin and Blockchain

Bitcoin is a decentralized digital currency that uses blockchain technology and cryptography to enable secure, peer-to-peer transactions without intermediaries (banks).

4.1 How Bitcoin Works

1. Blockchain: A distributed ledger where all transactions are recorded in blocks, linked cryptographically.
2. Mining: Validators (miners) solve complex puzzles to add new blocks (proof-of-work).
3. Cryptography:
   • Public-Private Key Pairs: Users generate keys; public keys are Bitcoin addresses.
   • Digital Signatures: Transactions are signed with the sender’s private key.
4. Decentralization: No single entity controls Bitcoin; transactions are verified by the network.

4.2 Advantages of Bitcoin

• No intermediaries: Eliminates banks/fees for cross-border transfers.
• Transparency: All transactions are public on the blockchain.
• Security: Cryptographic proof prevents double-spending.

4.3 Disadvantages of Bitcoin

• Volatility: Price fluctuates wildly (e.g., $60k → $16k in 2022).
• Irreversible: Transactions cannot be refunded (unlike credit cards).
• Energy consumption: Mining requires massive computational power.

| A visual of blocks linked by hashes, showing how transactions are immutable. |

Worked Example: Bitcoin Transaction Trace Scenario: Alice sends 0.5 BTC to Bob.

1. Alice’s wallet generates a transaction:

   {
     "from": "Alice’s Public Key",
     "to": "Bob’s Public Key",
     "amount": 0.5,
     "signature": "Alice’s Private Key Signs Hash"
   }
   

2. The transaction is broadcast to the network.
3. Miners validate it (checking signatures and balance) and include it in a block.
4. The block is added to the blockchain after proof-of-work.
5. Bob’s wallet receives the funds and updates its balance.

5. Security Threats and Countermeasures

Digital payments and cryptography face threats like ransomware, man-in-the-middle (MITM) attacks, and phishing.

5.1 Common Threats

5.2 Countermeasures

• Encryption: Use AES for data at rest, TLS for transmissions.
• Multi-Factor Authentication (MFA): OTPs + biometrics (e.g., Khalti’s fingerprint login).
• Firewalls & IDS: Block malicious traffic (e.g., Ncell’s network security).
• Regular Audits: Banks like Nabil Bank audit systems for vulnerabilities.

6. Real-World Applications

In the Real World

1. eSewa (Nepal):

   • Uses asymmetric cryptography to validate transactions between users and banks.
   • Digital signatures ensure no fraudulent chargebacks.
   • Example: When you pay a Daraz bill via eSewa, the app encrypts the transaction details before sending them to the bank.

2. Ncell Money (Nepal):

   • Leverages ACH-like batch processing for interoperator transfers (e.g., Ncell → Smart).
   • OTP authentication prevents unauthorized access to wallets.

3. NEPSE (Nepal Stock Exchange):

   • Uses blockchain-like ledgers for secure trade settlements.
   • Digital signatures bind traders’ identities to orders.

Mermaid Diagram: eSewa Transaction Flow

sequenceDiagram
    participant U as User
    participant E as eSewa App
    participant B as Bank
    participant M as Merchant

    U->>E: Initiates payment (e.g., Daraz order)
    E->>U: Requests OTP
    U->>E: Enters OTP (biometric + OTP)
    E->>B: Sends encrypted transaction (AES + digital signature)
    B->>B: Verifies signature & checks balance
    B->>M: Debits user, credits merchant
    M->>E: Sends confirmation
    E->>U: Displays "Payment Successful"

7. Exam Tips

1. Cryptography Types:

   • Always compare symmetric vs. asymmetric with pros/cons (e.g., "AES is faster but asymmetric solves key distribution").
   • Mention real-world use: AES for encrypting eSewa transactions, RSA for digital signatures.

2. Digital Signatures:

   • Explain the three-step process (hash → sign → verify) with a diagram.
   • Link to non-repudiation: "A digital signature proves Alice sent the message; she can’t deny it."

3. Bitcoin:

   • Describe the blockchain structure (blocks → hashes → miners).
   • Discuss advantages/disadvantages with Nepal examples (e.g., "Bitcoin avoids NBP fees but is volatile").

4. Digital Payments:

   • Compare ACH vs. e-wallets in a table (speed, cost, security).
   • Mention threats (phishing, MITM) and countermeasures (MFA, encryption).

5. Case Study Link:

   • For Nabil Bank’s ACH system, explain how it processes salary transfers securely.
   • For eSewa, describe how cryptography prevents fraud in merchant payments.

6. Short Notes:

   • ACH: "Batch-based electronic funds transfer; used by Nabil Bank for bulk payments."
   • Cryptography: "Symmetric (AES) vs. asymmetric (RSA); asymmetric enables digital signatures."

Final Visual: Cryptography in Daily Life