Encryption Ontology

FLOW ALGEBRA
Encryption Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/cybersecurity/encryption-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "EncryptionOntology" v4.0

# ---------- DOMAIN ----------
DOMAIN := ComputingOntology
SUBDOMAIN := Cybersecurity
ONTOLOGY := EncryptionOntology

# ---------- PRIMARY ENTITY ----------
ENTITY Encryption {
    definition:
        "A cryptographic transformation that converts readable information
         into an encoded form using an encryption algorithm and cryptographic
         key so that authorised entities can control access to the original
         information.";

    objectives: [
        Confidentiality,
        ControlledDisclosure,
        DataProtection
    ];
}

# ---------- CORE ENTITIES ----------
Plaintext := ReadableInformation;
Ciphertext := EncryptedInformation;

CryptographicKey := {
    SymmetricKey,
    PublicKey,
    PrivateKey,
    SessionKey
};

EncryptionMethod := {
    SymmetricEncryption,
    AsymmetricEncryption,
    HybridEncryption
};

EncryptionContext := {
    DataAtRest,
    DataInTransit,
    DataInUse
};

CryptographicOperation := {
    Encrypt,
    Decrypt,
    GenerateKey,
    ExchangeKey,
    DeriveKey,
    RotateKey,
    RevokeKey,
    DestroyKey
};

# ---------- FUNDAMENTAL TRANSFORMATION ----------
Encrypt(Plaintext, Key, Algorithm) -> Ciphertext;

Decrypt(Ciphertext, Key, Algorithm) -> Plaintext;

Plaintext
    -> EncryptionAlgorithm
    -> CryptographicKey
    -> Ciphertext;

Ciphertext
    -> DecryptionAlgorithm
    -> ValidKey
    -> Plaintext;

# ---------- RELATIONSHIPS ----------
Encryption IS_A CryptographicProcess;
Encryption USES CryptographicAlgorithm;
Encryption USES CryptographicKey;
Encryption TRANSFORMS Plaintext INTO Ciphertext;

Decryption REVERSES Encryption WHEN ValidKeyAvailable;

Ciphertext REPRESENTS ProtectedInformation;
CryptographicKey CONTROLS CryptographicTransformation;
Encryption SUPPORTS Confidentiality;

# ---------- SYMMETRIC ENCRYPTION ----------
SymmetricEncryption USES SharedSecretKey;

Encrypt(Plaintext, SharedSecretKey) -> Ciphertext;
Decrypt(Ciphertext, SharedSecretKey) -> Plaintext;

SymmetricEncryption HAS_PROPERTY {
    SameSecretForEncryptionAndDecryption,
    EfficientBulkEncryption
};

IF SharedSecretKey COMPROMISED
THEN ConfidentialityRisk := HIGH;

# ---------- ASYMMETRIC ENCRYPTION ----------
AsymmetricEncryption USES KeyPair;

KeyPair := {
    PublicKey,
    PrivateKey
};

PublicKey RELATED_TO PrivateKey;

Encrypt(Plaintext, PublicKey) -> Ciphertext;
Decrypt(Ciphertext, PrivateKey) -> Plaintext;

PrivateKey MUST_REMAIN Confidential;
PublicKey MAY_BE Distributed;

# ---------- HYBRID ENCRYPTION ----------
HybridEncryption :=
    AsymmetricKeyProtection
    + SymmetricDataEncryption;

Generate(SessionKey) ->
    Encrypt(Data, SessionKey) ->
    Protect(SessionKey, PublicKey) ->
    Transmit(EncryptedData, ProtectedSessionKey);

HybridEncryption COMBINES {
    SymmetricEncryption,
    AsymmetricEncryption
};

# ---------- KEY MANAGEMENT ----------
KeyLifecycle :=
    Generate ->
    Distribute ->
    Store ->
    Use ->
    Rotate ->
    Revoke ->
    Destroy;

KeyManagement GOVERNS CryptographicKey;

SecureKeyStorage PROTECTS CryptographicKey;
KeyRotation LIMITS ExposureDuration;
KeyRevocation INVALIDATES KeyUse;
KeyDestruction TERMINATES KeyAvailability;

IF KeyStrength < RequiredSecurityStrength
THEN EncryptionSecurity := INSUFFICIENT;

IF Key EXPIRED
THEN KeyUse := DENY;

IF Key REVOKED
THEN KeyUse := DENY;

# ---------- ALGORITHM MODEL ----------
CryptographicAlgorithm HAS {
    AlgorithmType,
    KeySize,
    SecurityStrength,
    ModeOfOperation,
    Parameters
};

EncryptionStrength :=
    f(
        AlgorithmSecurity,
        KeyStrength,
        ImplementationCorrectness,
        KeyProtection,
        ParameterSelection
    );

IF Algorithm IS Deprecated
THEN SecurityConfidence := DECREASE;

# ---------- DATA AT REST ----------
DataAtRest ->
    Classify ->
    DetermineEncryptionRequirement ->
    SelectAlgorithm ->
    SelectKey ->
    Encrypt ->
    StoreCiphertext;

EncryptionAtRest PROTECTS StoredInformation;

StorageEncryption MAY_APPLY_TO {
    File,
    Database,
    Disk,
    Backup,
    Device
};

# ---------- DATA IN TRANSIT ----------
DataInTransit ->
    EstablishSecureChannel ->
    EstablishKeys ->
    Encrypt ->
    TransmitCiphertext ->
    DecryptAtDestination;

EncryptionInTransit PROTECTS CommunicationConfidentiality;

IF CommunicationChannel IS Untrusted
THEN EncryptionRequirement := INCREASE;

# ---------- DATA IN USE ----------
DataInUse IS_PROCESSED_BY ComputationalSystem;

ProtectionOfDataInUse MAY_REQUIRE {
    ProcessIsolation,
    TrustedExecution,
    MemoryProtection,
    SpecialisedCryptographicTechnique
};

# ---------- IV AND NONCE ----------
InitialisationVector := CryptographicParameter;
Nonce := UniqueOrNonRepeatingValue;

EncryptionOperation MAY_REQUIRE InitialisationVector;
EncryptionOperation MAY_REQUIRE Nonce;

IF RequiredNonce REUSED
THEN CryptographicRisk := INCREASE;

IF InitialisationVector REQUIREMENT VIOLATED
THEN SecurityProperty MAY_BE_WEAKENED;

# ---------- AUTHENTICATED ENCRYPTION ----------
AuthenticatedEncryption :=
    ConfidentialityProtection
    + IntegrityProtection
    + AuthenticityEvidence;

AuthenticatedEncryption PRODUCES {
    Ciphertext,
    AuthenticationTag
};

IF AuthenticationTag INVALID
THEN DecryptionResult := REJECT;

# ---------- ACCESS RELATIONSHIP ----------
AuthorisedEntity POSSESSES_OR_ACCESSES ValidKey;
ValidKey ENABLES Decryption;
Decryption ENABLES PlaintextAccess;

UnauthorisedEntity WITHOUT ValidKey
SHOULD_NOT_OBTAIN Plaintext;

Encryption DOES_NOT_REPLACE {
    Authentication,
    Authorisation,
    IntegrityControl,
    KeyManagement
};

# ---------- THREAT MODEL ----------
EncryptionThreat := {
    KeyCompromise,
    WeakAlgorithm,
    WeakKey,
    ImplementationFlaw,
    IncorrectConfiguration,
    NonceReuse,
    KeyExposure,
    CryptographicDowngrade
};

EncryptionThreat TARGETS EncryptionSystem;

SecurityControl MITIGATES EncryptionThreat;

# ---------- SEMANTIC REASONING ----------
IF SensitiveData STORED
THEN Evaluate(EncryptionAtRest);

IF SensitiveData TRANSMITTED
THEN Evaluate(EncryptionInTransit);

IF Ciphertext EXISTS
AND ValidKey AVAILABLE
AND Algorithm SUPPORTED
THEN DecryptionPossible := true;

IF Ciphertext EXISTS
AND ValidKey NOT_AVAILABLE
THEN PlaintextRecovery := restricted;

IF PrivateKey COMPROMISED
THEN AssociatedConfidentialityRisk := INCREASE;

IF SymmetricKey COMPROMISED
THEN ProtectedDataRisk := INCREASE;

IF EncryptionAlgorithm STRONG
AND KeyManagement WEAK
THEN OverallEncryptionSecurity := WEAKENED;

IF EncryptionAlgorithm STRONG
AND KeyStrength ADEQUATE
AND KeyManagement SECURE
AND Implementation CORRECT
THEN EncryptionConfidence := HIGH;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "encrypt" ~= "encipher";
    "encrypted data" ~= "ciphertext";
    "unencrypted data" ~= "plaintext";
    "secret key encryption" ~= "symmetric encryption";
    "public key encryption" ~= "asymmetric encryption";
    "shared key" ~= "symmetric key" WHEN context == encryption;
    "key pair" ~= "public-private key pair";
    "data encryption" ~= "information encryption";
}

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_DATA_STATE(q) ->
    IDENTIFY_ENCRYPTION_METHOD(q) ->
    IDENTIFY_KEY_ENTITY(q) ->
    IDENTIFY_CRYPTOGRAPHIC_RELATIONSHIPS(q) ->
    MAP_TO_ONTOLOGY(q) ->
    APPLY_REASONING(q) ->
    SCORE_CONFIDENCE(q) ->
    RETURN_RELEVANT_KNOWLEDGE;

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        source_reliability,
        cryptographic_consistency,
        semantic_consistency,
        contextual_relevance,
        evidence_strength
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: Encryption;
    ontology: EncryptionOntology;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_algorithm:
        validate
        -> classify
        -> evaluate_security_strength
        -> relate
        -> integrate;

    new_key_type:
        validate
        -> classify
        -> map_operations
        -> map_security_requirements
        -> integrate;

    new_encryption_method:
        identify_algorithm
        -> identify_key_model
        -> identify_data_context
        -> evaluate_security_properties
        -> integrate;

    security_revision:
        update_algorithm_status
        -> update_key_requirements
        -> recompute_security_confidence
        -> regenerate_flow_hash;

    conflict:
        preserve_provenance
        -> compare_evidence
        -> adjust_confidence
        -> flag_review;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + EncryptionMethod
    + CryptographicKey
    + EncryptionContext
    + CryptographicOperation
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
EncryptionOntology
    -> IdentifyInformation
    -> DetermineProtectionRequirement
    -> SelectEncryptionMethod
    -> SelectCryptographicAlgorithm
    -> EstablishCryptographicKey
    -> EncryptPlaintext
    -> ProduceCiphertext
    -> ProtectKeys
    -> ControlDecryption
    -> RecoverPlaintextForAuthorisedEntity
    -> PreserveConfidentiality;

END FLOW