Cryptography Ontology

FLOW ALGEBRA
Cryptography Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/cybersecurity/cryptography-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "CryptographyOntology" v4.0

# ---------- DOMAIN ----------
DOMAIN := ComputingOntology
SUBDOMAIN := Cybersecurity
ONTOLOGY := CryptographyOntology

# ---------- PRIMARY ENTITY ----------
ENTITY Cryptography {
    definition:
        "The discipline of protecting information and communications through
         mathematical transformations, algorithms, protocols and keys that
         provide security properties such as confidentiality, integrity,
         authenticity and non-repudiation.";

    security_properties: [
        Confidentiality,
        Integrity,
        Authenticity,
        NonRepudiation
    ];
}

# ---------- CORE ENTITIES ----------
CryptographicPrimitive := {
    Encryption,
    Decryption,
    HashFunction,
    MessageAuthenticationCode,
    DigitalSignature,
    KeyDerivation,
    KeyExchange,
    RandomNumberGeneration
};

CryptographicModel := {
    SymmetricCryptography,
    AsymmetricCryptography,
    HybridCryptography
};

CryptographicKey := {
    SymmetricKey,
    PublicKey,
    PrivateKey,
    SessionKey,
    DerivedKey
};

CryptographicObject := {
    Plaintext,
    Ciphertext,
    Message,
    Digest,
    AuthenticationTag,
    DigitalSignature,
    Certificate
};

# ---------- FUNDAMENTAL RELATIONSHIPS ----------
Cryptography USES Mathematics;
Cryptography USES CryptographicAlgorithm;
CryptographicAlgorithm IMPLEMENTS CryptographicPrimitive;
CryptographicPrimitive PROVIDES SecurityProperty;
CryptographicOperation USES CryptographicKey;
CryptographicKey HAS KeyStrength;

Encryption PROVIDES Confidentiality;
HashFunction SUPPORTS Integrity;
MessageAuthenticationCode SUPPORTS Integrity;
MessageAuthenticationCode SUPPORTS Authenticity;
DigitalSignature SUPPORTS Integrity;
DigitalSignature SUPPORTS Authenticity;
DigitalSignature SUPPORTS NonRepudiation;
KeyExchange ESTABLISHES SharedSecret;

# ---------- ENCRYPTION ----------
Encrypt(Plaintext, Key, Algorithm) -> Ciphertext;
Decrypt(Ciphertext, ValidKey, Algorithm) -> Plaintext;

Encryption TRANSFORMS Plaintext INTO Ciphertext;
Decryption TRANSFORMS Ciphertext INTO Plaintext;

IF EncryptionKey INVALID
THEN Decryption := fail;

# ---------- SYMMETRIC CRYPTOGRAPHY ----------
SymmetricCryptography USES SharedSecretKey;

SharedSecretKey USED_FOR Encryption;
SharedSecretKey USED_FOR Decryption;

SymmetricCryptography HAS_PROPERTY {
    SharedSecret,
    EfficientBulkProcessing
};

IF SharedSecretKey COMPROMISED
THEN ProtectedConfidentiality := AT_RISK;

# ---------- ASYMMETRIC CRYPTOGRAPHY ----------
AsymmetricCryptography USES KeyPair;

KeyPair := {
    PublicKey,
    PrivateKey
};

PublicKey MATHEMATICALLY_RELATED_TO PrivateKey;
PrivateKey MUST_BE Protected;

PublicKey MAY_BE Distributed;
PrivateKey MUST_REMAIN Controlled;

# ---------- HASHING ----------
HashFunction(Message) -> Digest;

HashFunction HAS_PROPERTY {
    DeterministicOutput,
    FixedLengthOutput,
    PreimageResistance,
    SecondPreimageResistance,
    CollisionResistance
};

Digest REPRESENTS CryptographicFingerprint;

IF Message CHANGES
THEN Digest EXPECTED_TO_CHANGE;

HashFunction IS_NOT Encryption;
Digest IS_NOT ReversiblePlaintextRepresentation;

# ---------- MESSAGE AUTHENTICATION ----------
MAC(Message, SecretKey) -> AuthenticationTag;

VerifyMAC(Message, SecretKey, AuthenticationTag) ->
    Valid | Invalid;

MessageAuthenticationCode PROVIDES {
    MessageIntegrity,
    MessageAuthenticity
};

IF AuthenticationTag INVALID
THEN MessageTrust := REJECT;

# ---------- DIGITAL SIGNATURE ----------
Sign(Message, PrivateKey) -> DigitalSignature;

VerifySignature(
    Message,
    DigitalSignature,
    PublicKey
) -> Valid | Invalid;

DigitalSignature CREATED_BY PrivateKey;
DigitalSignature VERIFIED_BY PublicKey;

IF SignatureVerification == Valid
THEN {
    IntegrityEvidence := true;
    OriginEvidence := true;
};

# ---------- KEY EXCHANGE ----------
KeyExchange ->
    EstablishSharedSecret ->
    DeriveSessionKey ->
    SecureCommunication;

KeyExchange MAY_USE AsymmetricCryptography;
SessionKey MAY_USE SymmetricCryptography;

IF KeyExchange AUTHENTICATION_MISSING
THEN ImpersonationRisk := INCREASE;

# ---------- KEY DERIVATION ----------
KeyDerivationFunction(InputMaterial, Parameters) ->
    DerivedKey;

DerivedKey USED_BY CryptographicOperation;

KeyDerivation MAY_USE {
    Secret,
    Password,
    SharedSecret,
    Salt,
    Context
};

# ---------- RANDOMNESS ----------
CryptographicRandomness PRODUCES UnpredictableValue;

UnpredictableValue MAY_BE_USED_AS {
    KeyMaterial,
    Nonce,
    Salt,
    InitialisationVector
};

IF Randomness PREDICTABLE
THEN CryptographicSecurity := WEAKENED;

# ---------- NONCE AND IV ----------
Nonce := NumberUsedOnce;
InitialisationVector := CryptographicParameter;

CryptographicProtocol MAY_REQUIRE Nonce;
EncryptionMode MAY_REQUIRE InitialisationVector;

IF Nonce MUST_BE_UNIQUE
AND Nonce REUSED
THEN SecurityRisk := INCREASE;

# ---------- CRYPTOGRAPHIC PROTOCOL ----------
CryptographicProtocol :=
    ordered_set(
        CryptographicOperations,
        Messages,
        Keys,
        Rules,
        ValidationSteps
    );

ProtocolSecurity :=
    f(
        PrimitiveSecurity,
        KeySecurity,
        ProtocolDesign,
        ImplementationCorrectness,
        ParameterCorrectness
    );

StrongPrimitive DOES_NOT_IMPLY SecureProtocol;

# ---------- KEY LIFECYCLE ----------
CryptographicKey ->
    Generate ->
    Distribute ->
    Store ->
    Use ->
    Rotate ->
    Revoke ->
    Destroy;

KeyManagement PROTECTS CryptographicKey;

IF Key EXPIRED
THEN CryptographicUse := DENY;

IF Key REVOKED
THEN CryptographicUse := DENY;

# ---------- CRYPTOGRAPHIC SECURITY ----------
CryptographicStrength :=
    f(
        AlgorithmStrength,
        KeyStrength,
        RandomnessQuality,
        ImplementationSecurity,
        KeyManagementQuality,
        ProtocolCorrectness
    );

IF Algorithm DEPRECATED
THEN CryptographicConfidence := DECREASE;

IF KeyLength INSUFFICIENT
THEN CryptographicConfidence := DECREASE;

IF PrivateKey EXPOSED
THEN AssociatedTrust := REEVALUATE;

# ---------- ATTACK MODEL ----------
CryptographicThreat := {
    BruteForceAttack,
    KeyCompromise,
    CollisionAttack,
    ReplayAttack,
    ImpersonationAttack,
    ImplementationAttack,
    SideChannelAttack,
    ProtocolAttack,
    WeakRandomness
};

CryptographicThreat TARGETS {
    Algorithm,
    Key,
    Protocol,
    Implementation,
    CryptographicObject
};

SecurityControl MITIGATES CryptographicThreat;

# ---------- CERTIFICATE RELATIONSHIP ----------
DigitalCertificate BINDS Identity TO PublicKey;
CertificateAuthority MAY_ISSUE DigitalCertificate;
DigitalCertificate SUPPORTS PublicKeyTrust;

CertificateValidation ->
    VerifyIssuer ->
    VerifyValidity ->
    VerifySignature ->
    EvaluateTrust;

# ---------- SEMANTIC REASONING ----------
IF Confidentiality REQUIRED
THEN Evaluate Encryption;

IF Integrity REQUIRED
THEN Evaluate {
    HashFunction,
    MessageAuthenticationCode,
    DigitalSignature
};

IF Authenticity REQUIRED
THEN Evaluate {
    MessageAuthenticationCode,
    DigitalSignature,
    Certificate
};

IF NonRepudiation REQUIRED
THEN Evaluate DigitalSignature;

IF SharedSecretAvailable
AND HighVolumeData
THEN SymmetricCryptography MAY_BE_RELEVANT;

IF PublicKeyInfrastructureAvailable
THEN AsymmetricCryptography MAY_SUPPORT {
    KeyExchange,
    DigitalSignature,
    IdentityBinding
};

IF AlgorithmStrong
AND KeyWeak
THEN OverallCryptographicSecurity := WEAKENED;

IF AlgorithmStrong
AND KeyStrong
AND RandomnessStrong
AND ImplementationCorrect
AND ProtocolCorrect
THEN CryptographicConfidence := HIGH;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "crypto" ~= "cryptography" WHEN context == cybersecurity;
    "secret key cryptography" ~= "symmetric cryptography";
    "public key cryptography" ~= "asymmetric cryptography";
    "cryptographic hash" ~= "hash function";
    "message digest" ~= "digest";
    "digital signing" ~= "digital signature process";
    "shared secret" ~= "shared cryptographic secret";
    "key pair" ~= "public-private key pair";
}

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_CRYPTOGRAPHIC_PRIMITIVE(q) ->
    IDENTIFY_SECURITY_PROPERTY(q) ->
    IDENTIFY_KEY_ENTITY(q) ->
    IDENTIFY_PROTOCOL_RELATIONSHIP(q) ->
    MAP_TO_ONTOLOGY(q) ->
    APPLY_REASONING(q) ->
    SCORE_CONFIDENCE(q) ->
    RETURN_RELEVANT_KNOWLEDGE;

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        source_reliability,
        mathematical_consistency,
        cryptographic_consistency,
        semantic_consistency,
        contextual_relevance
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: Cryptography;
    ontology: CryptographyOntology;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_primitive:
        validate
        -> classify
        -> identify_security_properties
        -> relate
        -> integrate;

    new_algorithm:
        validate
        -> identify_primitive
        -> evaluate_security_status
        -> identify_key_requirements
        -> integrate;

    new_protocol:
        identify_primitives
        -> identify_keys
        -> identify_message_flow
        -> evaluate_security_properties
        -> integrate;

    security_revision:
        update_algorithm_status
        -> update_key_requirements
        -> update_protocol_status
        -> recompute_confidence
        -> regenerate_flow_hash;

    conflict:
        preserve_provenance
        -> compare_evidence
        -> adjust_confidence
        -> flag_review;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + CryptographicPrimitive
    + CryptographicModel
    + CryptographicKey
    + CryptographicObject
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
CryptographyOntology
    -> IdentifySecurityProperty
    -> SelectCryptographicPrimitive
    -> SelectCryptographicModel
    -> EstablishKeys
    -> ExecuteCryptographicOperation
    -> ValidateCryptographicResult
    -> ProtectKeys
    -> PreserveProtocolCorrectness
    -> MaintainCryptographicTrust;

END FLOW