Encryption NSA – used to be able to crack most codes, technology has changed that Encryption is the art of encoding messages so they can’t be understood by eavesdroppers. Descrambling the encrypted message usually requires a “key”. Encryption has been used since the beginning of human communication in 2001 after 9/11/01 bills were being developed to provide keys held in escrow by the government so all messages could be accessed by the gov. 10/24/2001 Patriot Act does not deal with any encryption – Why? Whispers, roman cipher ITEC 102

E-Commerce E-commerce has become a dominate force in the economy. Encryption is critical to successful e-commerce. TCP/IP – all packets are open to view at every node along its path. Must encrypt messages due to internet architecture. Should email be encrypted? How? “The question is whether people should be able to conduct private conversations, immune from government surveillance, even when that surveillance is fully authorized by a court order.” Ron Rivest, MIT Commerce greater importance than terrorist threat. Email can be made secure but by default it is not. ITEC 102

Cryptography and Cryptanalysis “secret writing” found in Egyptian hiertoglyphics in 200 BC Ceasar’s cipher – substitution cipher (“D” for “A”, “E” for “B”, etc.) plaintext -> cipher applied -> ciphertext -> decode -> plaintext Frequency analysis can be used to break basic ciphers If the key is long enough, frequency analysis does not work – one time pad – can not be broken if used only once. Information theory – Claude Shannon, 1948 tempting to re-use one-time pads due to work involved – results in breakable codes. Code makers and breakers Mary Stuart used a known broken cipher, Mafia used Caesar cipher ITEC 102

Encryption in the Internet age Encoded messages look indecipherable – false sense of security. No central authority to give software command upgrades Confidence is good but certainty would be better Fundamental Tenet of Cryptography: If lots of smart people have failed to solve a problem, then it probably won’t be solved (soon). Holy grail of crypo – a provably secure encryption algorithm Any encryption process must be used to work. Code makers and breakers Mary Stuart used a known broken cipher, Mafia used Caesar cipher, WEP, MD5, RFID Bad systems still used by many because they think it is secure. ITEC 102

The enemy will know the system In general, published encryption methods that are open to the public are more reliable than secret ones. Kerckhoff’s principle (the enemy knows the system) Content Scrambling system (CSS) used on DVD was secret (for a while). Diffie, Hellman, and Merkle – Public Key Cryptography, 1976 How does Alice send Bob a msg. in private without knowing each other? – Public Key encryption – relies on hard to factor big numbers. Digital signatures – verifying who sent it – RSA and VeriSign https – “secure” – transmission is encrypted – not the message once it is at the server. New keys generated each time – cheap Pretty Good Privacy (PGP) – now owned by Symantec ITEC 102