As we know CIA of the demand for security means:
I don't understand why define the "Integrity" and "Availability`,
You're focusing on a very narrow scope here. The CIA triad is about security of a whole system, not just an encrypted message.
That being said, all elements of the triad do apply to your example:
While Polynomial's answer is outstanding, it may aid the understanding of the CIA principle to add examples how each aspect can be broken, and how each aspect can be protected.
The purpose of Confidentiality is simply put to control "Who reads what?". Confidentiality can be broken if information is leaked to an unauthorized party. What kind of information that is depends entirely on the threat model. I'll give some examples:
As you can see, there is more to Confidentiality than just the content of the message. Metadata matters as well, and that is hard to encrypt. In general though, encryption is a good way to gain Confidentiality. In those specific examples however, further measures need to be taken to keep all compromising information confidential.
Integrity can be seen as the property that a message cannot be modified by an unauthorized party. Since this is often an infeasible goal, a good compromise is that any kind of unauthorized modification needs to be identifiable.
One of the first things you will learn about cryptography is to always use algorithms for what they were designed to do. Encryption is being used to guarantee Confidentiality, not Integrity.
A great example for this is the One-Time Pad. It is achieved by XOR'ing the message with a random key that is at least as long as the message. Let me give you an example. As message, we'll use
ATTACK AT 09:00
and as key, we'll use
jHiA015Ak4012Kf
This will result in the hexadecimal message
2b1c3d00737a15003f140008087b56
An attacker, knowing the rough format of the message, but not the content, can now change the ciphertext maliciously into:
2b1c3d00737a15003f140101087b56
With the same key, this will decipher into
ATTACK AT 10:00
This could prove to be a fatal outcome. The attacker still cannot read the ciphertext, so Confidentiality is still upheld, but by manipulating the ciphertext and the recipient not being able to detect that manipulation, the attacker got what they wanted.
Integrity can be upheld by adding some kind of code to the message that verifies if the message has been modified or not. A hash with a key, a cryptographic signature over a hash, etc. can all be used. The important part is that any modification to the message will be noticed, and that an attacker is not able to forge a valid authentication code themselves.
Availability is often looked down upon to those newer to security, as a kind of "nice-to-have" goal. But let me ask you: What good is a server that is perfectly encrypted and to which nobody could write to, if it was offline all the time?
Availability can be judged by many metrics, depending on each individual use-case. Sometimes it's uptime, sometimes it's response time, sometimes it's performance. Each of these factors could bring down a business if it was impacted in a major way.
Imagine if StackExchange would be down for "maintainance" 90% of the time, because some skiddie in ████████████ put bringStackExchangeDown.sh in a cronjob to run every 30 minutes. And the 10% where the site was online, it would be so slow that a 54k dial up modem seems blazing fast in comparison.
You would not want to use that site, and the attacker got what they wanted. Sadly, Availability can't be improved by throwing more crypto at it. Availability can only be improved by scaling up and wide, increasing redundancy, and by fixing bugs that would reduce Availability.
As other answers have mentioned, Confidentiality, Integrity, Availability is meant to apply, like, an entire datacentre application, not a single encrypted message.
That said, there is a slightly different definition of CIA that does apply: confidentiality, integrity, authentication -- for example, see Practical Cryptography in Python, Nieslon & Monson
Confidentiality
An attacker can not read your message. This one is self-explanatory.
Integrity
An attacker can not modify your message.
I will argue that this is orthogonal to confidentiality. Consider the following cases:
Authentication
That you know with cryptographic certainty who sent the message. Again, this is orthogonal to the other two because, at its core, it comes down to making sure that only one person has access to the private key that generated this message, and that you have a reliable way to map that key to the person. Examples that provide strong authentication are signatures produced by a key in a digital certificate, or AES_GCM where you are encrypting for yourself, ie you know that you must have created this message because nobody else has a copy of the key
I received training that specified CIA is not just a mnemonic for the three words, but also a way to remember their preferred order. That is, there is an established priority of:
in that order.
The line of reasoning is as follows:
Some people may be unconvinced that's best. I do think people may disagree with some of the above for some intelligent reasons, and come up with some convincing arguments for their alternate views.
What I've taught my students is that the above order is something good to be familiar with in case it shows up on an industry exam, and is good to understand so you can intelligently consider the benefits of that standard priority, even if there appears to be some good cause to have disagreement with some aspect.
