Intro into Cryptology

Digital signatures and asymmetric cryptography

Within Thunderbird e-mail client – you have the options to encrypt data by selecting some one’s public key – and/or digitally signing. Digital signatures are based on asymmetric cryptography and can provide assurances of evidence to origin, identity and status of an electronic document, transaction or message, as well as acknowledging informed consent by the signer.

To create a digital signature, signing software (such as an email program) creates a one-way hash of the electronic data to be signed. The user’s private key is then used to encrypt the hash, returning a value that is unique to the hashed data. The encrypted hash, along with other information such as the hashing algorithm, forms the digital signature. Any change in the data, even to a single bit, results in a different hash value.

This attribute enables others to validate the integrity of the data by using the signer’s public key to decrypt the hash. If the decrypted hash matches a second computed hash of the same data, it proves that the data hasn’t changed since it was signed. If the two hashes don’t match, the data has either been tampered with in some way (indicating a failure of integrity) or the signature was created with a private key that doesn’t correspond to the public key presented by the signer (indicating a failure of authentication).

A digital signature also makes it difficult for the signing party to deny having signed something (the property of non-repudiation). If a signing party denies a valid digital signature, their private key has either been compromised, or they are being untruthful. In many countries, including the United States, digital signatures have the same legal weight as more traditional forms of signatures.

Getting to Know the Basic Terms:

I’m going to start you off with some introductory terms. These are not meant to confuse you; rather, they are meant to gradually introduce you to some of the lingo used in cryptography.

Encrypt: Scrambling data to make it unrecognizable
Decrypt: Unscrambling data to its original format
Cipher: Another word for algorithm
Key: A complex sequence of alpha-numeric characters, produced by the algorithm, that allows you to scramble and unscramble data
Plaintext: Decrypted or unencrypted data (it doesn’t have to be text only)
Ciphertext: Data that has been encrypted

Cryptography through the ages

Making secret messages and then sending them on to someone else to figure out is nothing new. The ancient Greeks used ciphers to send secret messages to their armies in the field. Benedict Arnold used a cipher based on a book called Blackstone’s Commentaries (a book of essays about the law). In one sense, the Egyptian hieroglyphics can also be considered to be ciphers.

Ciphers really came into their own during WWI and WWII. Entire military and government departments were dedicated to the tasks of coming up with new methods of making secret messages. In addition to making secret messages, these offices also had to figure out how to decrypt the enemy’s secret messages. It was from that base of intelligence that modern cryptography has come to be. The government soon discovered that, war or no war, they still had to create secret messages.

Why Encryption Isn’t More Commonplace?

Until fairly recently, it was unlawful for average American citizens to even own encryption technology. That was the realm of the NSA, and all encryption products were tightly controlled. In the early 1990s, a number of privacy activists and cryptographers helped loosen the restrictions on who could own encryption, and the courts have since ruled that we have the right to privacy in our communications and storage of our own data. Given that our right to own and use encryption is so new, it’s not surprising that not many people know much about it.

Now the market is burgeoning with new products and encryption technologies, which makes it even more difficult for people to decide what to buy and implement — if they decide on encryption at all! However, some states are passing laws stating that companies that store personal information need to use cryptography to protect that information. It’s likely that we will see a wave a new laws like these over the next five years. Another thought that comes to mind is the Internet. Again, until recently, we trusted the Internet and saw no need to protect ourselves. But with hacking and identity theft becoming more common, it makes sense to start looking at ways to protect ourselves and our information.

Difficulty in understanding the technology

By and large, encryption programs have suffered from a lack of intuitive interfaces — if people don’t understand how to use the software, they won’t use it. Period. This is the fault of the developers. They seem to have forgotten that cryptography is new to most users. The graphical interface to many encryption programs was almost indecipherable, even to people like me who know what they are doing. It’s no wonder then that people who have bought encryption products have never gotten around to use them. They don’t know how to work the commands and menus.

Another reason people find cryptography so hard to understand is that the creators of cryptosystems — usually mathematicians — are the same ones who have written most of the textbooks explaining the subjects. Now, I don’t want aeronautical engineers explaining to me how a plane flies because I won’t understand what they are saying. For that same reason, I don’t want a mathematician to explain to me how to encrypt my e-mail.

Because of this I have taken the non-mathematical route to explaining how cryptography works. Luckily, things are changing in the world of cryptography. User interfaces for encryption products are becoming easier to use. The vendors themselves are also helping by putting large amounts of “How-To” information on their Web sites with FAQs (Frequently Asked Questions) to help you find the answer to your problem.

You can’t do it alone

One of the biggest problems with cryptography is that you can’t do it alone! You need at least two people — a sender and a receiver. Otherwise, the encrypted files or messages just sit there. It’s sort of like when the first video phones appeared — there was no sense in buying one for yourself if you didn’t have anyone to call who had one, too. What’s the point in showing your face on the telephone line if there’s no one on the other side to see it?

If you’re going to be receiving encrypted files and messages, you need to have the same software, or compatible software, as the sender. That’s simple common sense. Likewise, if you are sending encrypted files or messages, you need to be sure that the people on the receiving end have some means of decrypting what you’ve sent.

Luckily, many products operate on similar standards and can be made to work with similar products. It may take a bit of trial and error to get it working correctly, but the good news is that you usually have to do that only once.

Special administration requirements

If you are running a business a law firm a Political Party or any kind of specialist interest group you need professional people. Crypto products require special handling, which means that you need to have experienced staff to operate and maintain the systems. This is not something the accountant can do as an adjunct to his or her normal duties; you need a skilled professional. Why? Because if your crypto systems are not set up and maintained correctly, you run the risk of exposing all of your secrets. In addition, your staff will lose their keys and forget their passphrases, and new users need to be added to the system and trained on its use. If you’re trying to increase the security of your system and protect your company’s assets, you might as well do the job as well as you can. In this case, “good enough” sometimes isn’t enough.

Beware of “Snake Oil”

In most software and hardware markets, the latest and greatest product is the one that everyone wants. People like all the bells and whistles in the new product, and they gobble up the marketing literature that gives you 101 reasons why this product is the answer to all of your prayers. In the world of cryptography, almost the exact opposite is true — nothing new is trusted until it has been extensively tested by the outside world.

Snake oil refers to any crypto product that vendors oversell as a cure-all. It harkens back to the frontier days when pharmacists and traveling salesmen sold products of a dubious nature that were supposed to cure everything. They wouldn’t tell you exactly what was in it, but they assured you that it worked.

Cryptographic software and hardware has sometimes been sold the same way. The makers of this magic stuff all assure you that it works in “new and previously untried ways.” The salespeople will make promise after promise of all the wondrous things the software is capable of, but will not be able to provide you with one verifiable test that upholds their claims. Nor will they give you any technical data on the inner workings of their product. These things should be enormous red flags to potential buyers. If you can’t get hard data on how a cryptosystem works, it’s very likely to be snake oil. Buy it and you will get bit by the snake.

Here are some things you should look out for when reviewing cryptosystems for signs of snake oil:

The marketing literature and technical literature are full of technobabble. If you can’t make sense of what is being said, how can you expect to be able to implement it? Run it by your IT Department to see if they can make sense of the hype. These types of cryptosystems are trying to baffle you into thinking they are brilliant.

The company tells you that the algorithm is unbreakable. Believe me when I tell you that every algorithm is breakable. It may take 100 years or 10,000 years, but someone will find a way of breaking the algorithm.

They claim that their product uses military-strength encryption. Do you really think that the military would tell the general public which algorithms they use? Exactly how safe would the military’s secret be if every terrorist group in the world knew what they were using? Of course, some sales people confuse the term “military strength” with the fact that the encryption has been reviewed by the military.

Just because the encryption has been reviewed by the military (or the NSA) does not necessarily equal military strength.

They claim to use secret algorithms. That’s right up there with “military- strength” encryption as a red flag indicating snake oil. All the crypto experts will tell you that for an algorithm to be determined good, it has to be tested by people who had nothing to do with the development of the algorithm. It’s a commonly known fact that writers can’t see their own typographical errors — that’s why there are editors. In the same vein, developers of algorithms can’t see their own errors, and it takes an outside expert to discover them. There are scores of mathematicians who are ready, willing, and able to test algorithms. Some of them even do it for a living.

The claim that You don’t need to know what the product is doing or the Trust Us plea is a good indication of snake oil. This usually means that either the vendor doesn’t know how the product works or they are just lying to you.

They claim that the algorithm has been tested by hackers is totally bogus. Excuse me, but hackers don’t know much about algorithms; they know operating systems, network protocols, software, and programming. This does not make them experts in cryptography.

They claim that experts evaluated their product and found it safe or strong. If a vendor is using experts, they won’t mind listing the papers the experts have written. These papers are often used to establish who is an expert and who is not. Chances are that if you’ve never heard of the expert and the expert has never been published, that person is not an accepted expert on the subject.

They claim that the software and/or algorithm are exportable from the U.S. is also a red flag. For those who are not aware of it, the U.S. government restricts the export of strong encryption to many foreign countries. If the encryption used in the product you are considering is “export strength,” it could mean that it’s not very strong (like only 40-bit encryption). If the encryption is “strong” and the vendor states that it is “exportable,” that could also mean that you may have to comply with a number of government rules and regulations concerning its export.


This entry was posted in Cryptology, Science. Bookmark the permalink.