Encryption Basics - 27 Jul 2001

In previous columns, I've discussed encryption as it relates to pretty good privacy (PGP) and secure email. Many readers have asked for further details describing exactly how encryption works. Although it's difficult to do justice to such a complex topic, this Small Office/Home Office (SOHO) Security column can serve as a primer on how you can use encryption to make your data more secure. I've tried to explain the portions of theory you will encounter most often; for detailed information, I suggest you type in "encryption" in your favorite search engine to get explanations of how encryption works.

Encryption Types
Symmetric key and public key are the two main types of encryption. With symmetric-key encryption, the simplest of all types, two computers share a common key before the sender transmits an encrypted message. One user composes a message, uses a key to encode it, and sends the message. The intended recipient, who receives the common key ahead of time, uses the key to decrypt the contents of the message. (The symmetric-key method is similar to coded logic puzzles that use a unique pattern—for example, a code that shifts four letters back, so that E is really A, F is B, and so on. Both the sender and the recipient know the code pattern and can decode the message.) The main disadvantage to symmetric-key encryption is that both the sender and the recipient must receive the common key before they can send and receive the message.

The other type of encryption, public key, is more complicated. Public-key encryption uses two kinds of keys—private and public. The sender's computer keeps the private key confidential, but distributes the public key to any other computer that requests it. To decode a message, the intended recipient uses the distributed public key and a private key on the recipient's computer. Computers base the keys on hash values, which are mathematical values that the computer creates using a hashing algorithm to form a base numerical sequence. In effect, hashing creates a summary of the original data. Using the hashing method is secure because it's nearly impossible to determine the original base (sequence of numbers) from which the algorithm generated the hash without knowing the numerical sequence the hash used.

Although computers can use algebra to calculate the numerical sequence of a short sequence of numbers, public keys typically use a long sequence of numbers, including 40-bit and 128-bit numbers. Mathematically, 128-bit numbers have 2128, or 3,402,823,669,209,384,634,633,746,074,300,000,000,000,000,000,000,000,000,000,000,000,000 possible combinations for the numerical sequence. It's extremely difficult and very time-consuming to determine a hash number from this pool of combinations.

Public Key Infrastructure
When companies distribute public keys on a large scale, the encryption infrastructure requires an added process not unlike a trusted middleman. Several companies have built a business around distributing digital certificates for electronic documents. Independent security firms (e.g., VeriSign) issue digital certificates to various Web sites and servers. A digital certificate verifies that the sending computer’s reported identity is the same as its actual identity. The central authority (the trusted middleman) distributes the public keys to both the message sender and the intended recipient. Secure Sockets Layer (SSL), a widely used public-key protocol technology that Netscape developed, is one implementation of this concept. You might be familiar with the small lock icon that appears in various Web browsers when you're accessing certain Web pages. The icon and Web addresses that have the https:// prefix instead of http:// indicate the site you are visiting is an SSL-enabled site.

Public-key computing is resource intensive. To make encryption more efficient, some security firms use a hybrid encryption that combines public-key coding with symmetric keys. After a computer has established a secure socket, the system creates and distributes a symmetric key to the other computer through public-key encryption. After the recipient computer receives the symmetric key, both computers stop using public keys and use the simpler, less resource-intensive symmetric-key process. When the session ends, both computers destroy all the keys they created for that session.

Authentication
Encryption serves its purpose well, but these security measures are worthless if the sender and recipient are not who they say they are—that’s where authentication comes in. In addition to verifying identities, authentication creates a trusted environment. If you can trust the source sending the message, you can reasonably assume that no one has altered the information the source transmits to you. Working together, authentication and encryption create a secure communication environment. A password is the common form of authentication, requesting that a user enter a secret phrase that the authentication process can check against the same phrase in a secured file. If the passwords match, the user gains access to the message; if not, the computer denies access. Passcards are another popular form of encryption. Most often, hotels and other public buildings use passcards in entrance security systems.

Although digital signatures are fairly common, they're often unfamiliar to users. Basically, digital signatures ensure the authenticity of a transmitted document. The Digital Signature Standard (DSS) is based on a type of public-key encryption method that uses the Digital Signature Algorithm. The US government endorses the DSS format for digital signatures. The Digital Signature Algorithm consists of a private key that only the originator (the signer) of the document knows and a public key. If anyone changes anything in the document after a user has attached the digital signature, the computer changes the value used to compare digital signatures, invalidating the digital signature. As you can see, encryption is especially important for SOHO users who need to share documents securely. Although I've only given you a prime, all SOHO users should bone up on encryption before sending that next email.