Article, March 2010
A Big Word That Helps Keep The Internet Secure.
By Phil Sorrentino, President,
Sarasota PCUG, Florida July 2009 Monitor
president (at) spcug.org
This article has been obtained from APCUG with the author’s permission for publication by APCUG member groups; all other uses require the permission of the author (see e-mail address above).
You may have asked yourself some of the following questions. How secure is the internet? What has been done to make the Internet secure? How safe is my private information during an internet transaction? If so, read on; if you are a very trusting individual and figure that “they” will keep the internet secure, jump to the next article. During this time when the Internet provides essential communication between tens of millions of people and is being increasingly used as a tool for commerce, security has become a very important issue. And when it comes to computers, “security” is of concern on many different levels. There is physical security that keeps your computer hardware from being stolen. There is software security that keeps people out of our private files. There is “malware” security, that keeps your computer software from being infected with viruses, spyware, worms and the like. And finally there is “network” security that keeps private data protected as it goes from one computer (or client) on the internet to another computer (or server) on the internet. This article deals with network security, which is ensured by applying cryptography to messages that are transmitted on the Internet.
Remember the “s” in “https://” and the little lock icon on the browser when you went to a “secure” website? Well, cryptography is behind all that security. Cryptography is used to secure Internet and even telephone communications. Cryptography is nearly as old as written language itself. It was invented to address the age-old question: How can I communicate with my friend, so that no one else will know what was communicated? Cryptography becomes necessary whenever one is attempting to communicate private information over an “un-trusted” medium, such as the Internet. Typically, you can be sure that the message you send over the internet will get to its destination, but you cannot guarantee that intermediaries (computers along the way) will not be able to see and read your message, unless it is protected. With a collection of not-so-expensive equipment and a good deal of knowledge, a message on the internet can be intercepted (sniffed), and if it is “plain text”, it can be read. For mundane e-mail messages, this is not much of a concern, but for messages that contain private information, such as passwords or bank account or social security numbers, this could be an invitation for Identity Theft.
Cryptography to the rescue. Cryptography (from the Greek for "hidden writing") is the ancient science of encoding messages so that only the sender and receiver can understand them.
Cryptography can be defined as the conversion of data (plain-text) into a scrambled code (cipher-text) that can be sent across a network, and deciphered by the rightful receiver at the other end. There are two main techniques used to encrypt data, Symmetric and Asymmetric. Symmetric encryption uses the same key for encryption as it does for decryption. Symmetric encryption is also called Secret-key encryption because the key is kept a secret between the two cooperating parties. Asymmetric uses separate keys for encryption and decryption. Asymmetric encryption is also called Public-key encryption because one of the keys is allowed to circulate in the public (and one is kept private). Cryptography is now available to everyone thanks to the development of modern computers, which can perform more mathematical operations in a second than a human being could do in a lifetime. An ordinary PC, with the proper software, can produce codes of such complexity that the most powerful supercomputer using the best available software could not break them in thousands of years. Before modern times and the personal computer, cryptography was concerned solely with message confidentiality. Message confidentiality is conversion (encryption), of messages from a “plain-text” form into an incomprehensible one (cipher-text) for transmission and then back again to the original form, at the other end (decryption). This keeps the message unreadable by interceptors or eavesdroppers who do not have knowledge of the “key” needed for decryption of that message. (With the advent of the personal computer and the proliferation of digital information, the field of digital message protection has expanded beyond only confidentiality concerns to include techniques for message integrity checking, identity authentication, digital signatures, and password protection all of which we will leave for future discussions.)
As stated above, Secret key cryptography refers to encryption methods in which both the sender and receiver share the same key. Secret key cryptography is ideally suited to encrypting long messages, providing privacy and confidentiality for messages typically used in computer to computer transactions. Public Key Cryptography refers to methods in which two keys are owned by each participant, one for encryption (public key) and one for decryption (private key). Public Key cryptography is suited to short messages and is typically used to exchange “secret keys” between two computers. Public Key cryptography could, theoretically, also be used to encrypt messages but this is rarely done because Secret-key cryptography is about 1000 times faster than Public-key cryptography.
So, just how do these schemes work in our typical computer to computer (network) communications? Secret-key and Public-key cryptography are used to setup and maintain a secure data path from a client (your computer browser) to a server (information or data storage system). Because Secret-key cryptography is best used for long messages, a secret key will be used to encode all messages during the transaction. But how do we get a secret key to be used by both computers for the transaction. In comes Public-Key cryptography. Public-key cryptography, which is best suited for short messages, is used to send the secret key (which is short) from one computer to the other, so that both will have the secret key for encoding the messages that follow. The server has a public key for the client (your computer) and it encodes a “secret key” with that public key. It then sends the encoded message to the client and the client can then decode the message with its private key. The private key is used to decode the “secret key message” so that the client knows what to use as the secret key for subsequent message encoding (i.e., the decoded secret key). This all sounds very complicated, and it is, but all of this is controlled by the “secure software protocols” and you, the user, don’t have to get involved at all. (I’ve actually simplified the operation a bit, but the essence of how cryptography is used is still pretty accurate.) So, with the use of Public-Key, and Secret-Key cryptography, you can rest assured that the messages you are sending over the Internet will not be of any value to anyone attempting to intercept such information.
What more could you ask for - through the use of cryptography, the un-trusted Internet can now be used to send private messages, therefore providing secure communications, over the Internet, for everyone.Click here to return to top