A Hybrid Encryption Method for Data Security Based on ARB3 Algorithm

Cryptography systems have relevance in the process of guaranteeing security of information. Cryptography form’s part and parcel of modern protection of information. Economics describes cryptography as the process of modifying the readable messages to unreadable messages in a way that the true receiver of the message can read the message. The cryptograph is a term that is made using Greek terms kryptos, meaning hidden or secret and graphia meaning writing [1]. Cryptographic algorithms are very instrumental in maintaining confidentiality, authenticity, and integrity of data [2].

Cryptographic systems are commonly classified into symmetric, asymmetric and the hash- based cryptographic systems. Both of them include advantages and disadvantages:

1.1 Classification of cryptography

1.1.1 Symmetric cryptography

Symmetric encryption is one whose encryption and decryption are carried out using a shared key. Many well-known symmetric algorithms are AES, DES, and Blowfish [3]. The most commonly used AES is fast allowing a time complexity of about O(1) per block when used normally. Symmetric cryptography, however, is blind to the secure distribution of keys, and that becomes a big problem in an untrusted environment.

1.1.2 Asymmetric cryptography

Public-key cryptography or more generally asymmetric cryptography, utilizes two different keys: an encryption key, which is called a public key, and a decryption key, which may be called a secret key or a private key [4]. As an example, RSA offers good security features like authentication, non-repudiation and integrity [5]. But the operations of RSA are very computationally heavy, with a time complexity of O(n 3) measured in terms of key size. This is not efficient in encrypting big volumes of data.

1.1.3 Hash function

A hash function is a function that turns input content into a fixed-size digest and provides properties of determinism, efficiency, and resistance to pre-image and collision attacks [6]. Algorithms that are now considered insecure, such as MD5, have been retired; however, SHA-256 is considered secure. Also present is a more recent alternative, BLAKE3 which is significantly faster than classical hash functions (and reaches a speed of greater than 4 GB/s on a modern CPU) due to its optimizations and offers the same cryptographic guarantees [7].

1.1.4 Hybrid cryptography

The concept of mixed cryptography is characterized by various cryptographic schemes implementation and the possibility to achieve a performance-rich solution with an insignificant sacrifice of efficiency versus security. Encrypted data that is securely carried by using an asymmetric key would be usually offered in a symmetric key. Hybrid cryptography is the technique for better overall compute costs and usage of a secure key exchange.

Hybrid cryptography is currently being implemented much more widely as hybrid cryptography describes some of the following examples:

•HTTPS/SSL/TLS - based on the asymmetric key exchange, and a symmetric encryption of a session.

•E-mail Encryption (PGP/S-MIME) - having the symmetric keys are sad secured with an asymmetric methodology.

•Cloud Storage - provided many companies fast encryption and secured key [8].

•VPN - used an RSA algorithm to exchange and the key to enter a tunnel and associate the tunnel with AES.

•E-commerce - secured highly sensitive information with bulk encryption and key management process through the use of hybrid cryptography.

1.1.5 Why prefer hybrid cryptography

The combination of asymmetric and symmetric encryption enables hybrid models as shown in Table 1 to outperform individual techniques in both speed and security [9].

•The speed of data encryption is relatively high with AES encrypting approximately 1.5 GB/s as opposed to RSA whose encryption is fast through small keys.

•RSA-2048 key operations can take tens of milliseconds per transaction and AES-128 can operate on blocks at microsecond speeds.

•Hybrid systems lose major key management risks while enabling large scale fast data encryption.

1.2 Advanced encryption standard

The enhanced encryption standard is called AES [10]. This one is a member of the symmetric block cipher algorithm family. It encrypts and decrypts by means of a 128-bit, 192-bit, or 256-bit key. As seen in Figure 1, this technique makes use of an SP network with various rounds, which again rely on the size of the key being used [11]. In every round, there are four stages:

1. In the initial phase, we replace the bytes.
2. In the second phase, we move the rows.
3. We then combine the columns.
4. After that, we give it the round key.

1.png

Figure 1. AES encryption and decryption system

1.3 Rivest-Shamir-Adleman (RSA)

RSA is asymmetric, means it uses two distinct keys: a private key and a public key. The private key is confidential and the public key is passed on to everybody. Rivest, Shamir and Adleman are attributed to the invention of RSA algorithm. The most famous aspect of RSA is its encryption method that is secure. The exponential usage of positive integer prime integers for encryption and decryption is the core idea behind RSA [12]. The RSA algorithm works in the following manner as shown in Figure 2.

This method applies two variables exponents namely ‘e’ the exponent of public and ‘d’ the exponent of the private. As plaintext, M, and ciphertext, C define the specified encryption, and decryption process as follows: the encryption and decryption procedure [13].

2.png

Figure 2. RSA algorithm

1.4 BLAKE3

It is a cryptographic hash function developed to offer integrity and authentication of data while having higher efficiency and security with a fixed-size hash output. The primary functionality of obtaining one-time hash from the input data in BLAKE3 is to map integrity in data. In this way, BLAKE3 carries much importance in holding accuracy along with trustworthiness of transmitted information.

The performance. Software comparing the two SHA-3 finalists' performance shows that Blake is almost three times faster than Keccak on a contemporary CPU for a 512-bit hash [14], but only 1.26 times better for a 256-bit hash. Performance is expressed in cycles per byte.

The primary steps involved in BLAKE3 operation are as follows:

Chunking: The data text is divided to the pieces of data where the standard size is 1 KB. Parallel execution is made possible by the independent processing of these portions. Padding is applied to finish the chunk if the data is less than 1 KB. Every chunk has attributes like chunk length and whether it is the last chunk, along with an identifier (such as its position in the data) [15].

Compression Function: Compression Function: A compression function that carries out cryptographic mixing receives each chunk. This function applies operations like addition, XOR, and bit rotation on a set of 32-bit words. It is based on Blake2's permutation function. Simple patterns won't show up in the output since the mixing stage makes Sure the input data is evenly distributed throughout the chunk.

Merkle Tree Structure: A binary Merkle tree is constructed out of the hash values of the every chunk. This continues up the tree until pairs of chunks have been combined and have their for that combination, and then are squashed into single parent nodes. Due to this architecture, BLAKE3 could efficiently allow parallel computation in that chunks are computed in parallel where they are then merged.

Finalization: Using particular domain settings and keys, the root node—which stands for the sum of the hashes of all the chunk goes through a last compression stage. It is a procedure supplying security and originality to the ultimate hash. The output is either truncated or expanded to reach a length equivalent to the desired length usually of 256 bits or the average size of output of BLAKE3.

Output: The final hash is displayed in hexadecimal format as a 256-bit digest. This digest can be used as a fingerprint for data comparison or to confirm the integrity of the data, among other uses [16].

As demonstrated in the architectural diagram of BLAKE3 (Figure 3), a hash function accepts the input, and it gives the fixed-size hash value that uniquely represents the data. Therefore, it is very efficient and secure; hence it can be applied in hybrid systems for data integrity verification. Hybrid cryptography checks whether there is any change in the data during transmission or not. It does this by taking the hash values of the plaintext data before and after transmission and comparing them.

3.png

Figure 3. Architecture of the BLAKE3 hash function

The Table 1 shows the comparative analysis of the different hybrid cryptographic algorithms that have been implemented in the past works. This assessment aims at analyzing the performance of these algorithms in solving the cloud security problems where efficiency and reliability are equally significant. Parameters taken into consideration include the encryption time, the decryption time, memory used, and the time complexity. It would be necessary to measure the encryptions/ decryptions times that directly impact the speed of data security and retrieval during the real application. On the same note, the memory consumption helps to report on the efficiency of the algorithms in the application of resources, which is essential in computing setups with low affordability. Time complexity further on demonstrates the scalability of these approaches indicated how the algorithms scale with respect to larger datasets or high system loads. In order to have a complete performance analysis, a throughput calculation based on a specific formula, which measures execution speed and the data size, was also carried out. This makes it possible to compare the efficiency of the varying models of cryptography directly. The consolidation of these metrics gives a clear picture of the trade-offs between the strength of security and the computational performance of the hybrid cryptographic schemes.

Hybrid cryptography combines the elements of symmetric and asymmetric encoding and hashing; it exploits the superior security of AES, RSA, and BLAKE3 to securely protect massive sets of data with low performance overhead. At the start of the process, the primary data is encapsulated by an encryption method known as symmetric encryption of AES. Since AES is classified as a block cipher that ensures very high level of security at minimal performance reductions, it was chosen due to its high processing speed to encode masses of input texts.

The AES key itself must next be encoded using an asymmetric algorithm in this case, RSA. RSA uses a pair of keys, one a particular key that is used to decrypt and a second key may be shared which is used to encrypt. Due to this, the recipient of an AES key who knows of the corresponding private RSA key only will be capable of decrypting the key obtained with RSA, obtains the AES key, and unlocks the encrypted data. The key and block sizes of AES, RSA and BLAKE3 are represented in Table 2.

The last step is to create a tamper-proof hash of the original data using the cryptography hash function BLAKE3. Because BLAKE3 creates a distinct fingerprint of the data, unwanted modification and alteration are easily identified and prevented, allowing integrity testing. It is believed to be among the keenest ways of making sure that integrity is not compromised at the expense of speed because of its hashing speed and security.

Together, this hybrid approach strengthens security by transferring, as noted above, the speed of AES, the RSA benefit on key management, and the integrity guarantees of BLAKE3 into a powerful and secure cryptographic solution for modern applications.

After the user calls the application, it opens and the user may then choose a file to be encrypted through the use of the choose file button. The files path where it is chosen is shown in the entry box. When the user clicks the button labelled with Encrypt File, the actual encryption properly is begun by recording the time it begins and the memory usage. It is followed by the AES encoding where salt is randomly generated, and finally, the AES key would be derived with the help of PBKDF2HMAC. The chosen file is encoded using this AES key. The second procedure is RSA encryption protocol, in which the generation of keys is put into effect including the generation of the private and public key along with the RSA public key encryption employed to encrypt the AES key. BLAKE3 must then be used to hash the data and the AES key encoded. You have the option of storing the encrypted file and this will make changes to the time and memory utilization of the encryption. As much as the Tkinter window shows a graph between encryption time and memory, all this data will be plotted on the GUI.

Table 2. Cryptographic algorithm characteristics: Key size and block size for AES, RSA, and BLAKE3

Similar to decryption, decryption is started by clicking the "Decrypt File" button. After the duration and memory is recorded, a copy against the BLAKE3 hash that generates the RSA-encrypted AES key and AES-encrypted file contents is recorded. The RSA secret key is used to decode the final AES key so as to decrypt the contents of the encoded file. Then the encrypted file is requested to be saved and the memory consumption and the descrambling time is updated and displayed. Consequently, the graph of the decryption time and memory usage is shown in a Tkinter window. Consequently, such procedures would complete the encrypting task and offer the user encryption decryption information.

Flowchart: A multi-step process to encode and decode a file using the combination of the AES, RSA, and BLAKE3 hashing algorithms.

1. Start and Upload File: Here is the start of the uploading file and will be encrypted. It then undergoes several stages of the process of encoding.
2. AES Encoding: The algorithm Advanced Encryption Standard carries out the first level of encryption once after the file has been uploaded. Often referred to as the first level of encryption, AES encodes file data and produces a partially encrypted output.
3. A Random Key the RSA algorithm is used for RSA encryption. In order to attempt to secure the AES key, the RSA is used to encipher the AES key found with the first layer. The second-layer encoding will result from this phase.
4. BLAKE3 Hashing: Then the file data encoded by AES and AES key encoded by RSA are fed together into the BLAKE3 hashing algorithm. BLAKE3 is fast and secure hashing algorithm that has added an additional layer of the encryption.
5. Save Encrypted File: Finally, the place where the last encrypted data is written is discovered when the hash is complete. Here the encryption is complete and the file is encrypted and safe.
6. Decryption Process - Upload encrypted file: The first stage of decryption process is uploading the encrypted file once again.
7. BLAKE3 Decryption: Reverse BLAKE3 hashing to recover RSA-encrypted AES key along with AES-encrypted file data.
8. RSA Decryption: It employs secret RSA key that decrypts the AES key in a decryption process needed in the decryption of the file data.
9. AES Decryption: Data of the files that are encrypted at the initial level of the encryption is recoded with the help of the retrieved AES key.
10. Save decrypted file: Then the decrypt file is saved that an end.

In the whole workflow, multi-layered encryption security could be achieved using symmetric (AES) encryption techniques along with asymmetric (RSA) encryption. These would come in the context of integration with the integrity and hashing capability of BLAKE3. It will enhance data confidentiality and protection against unauthorized access as shown in Figure 4.

4.png

Figure 4. Proposed ARB3 algorithm flowchart