Private Key Encryption. Advance encryption standard (AES) is a 128-bits encryption technique that has become a U.S. government standard for private key encryption. The AES algorithm uses a single key known to both the sender and the receiver of the message. To encode a message, the sender provides the encryption algorithm with the key, which is used to produce a ciphertext message. The message enters the communication channel and is transmitted to the receiver’s location, where it is stored. The receiver decodes the message with a decryption program that uses the same key the sender employs. Figure 3.4 illustrates this technique.
Triple-DES encryption is an enhancement to an older encryption technique called the data encryption standard (DES). Triples DES provides considerably improved security over most single encryption techniques. Two forms of triple-DES encryption are EEE3 and EDE3. EEE3 uses three different keys to encrypt the message three times. EDE3 uses one key to encrypt the message. A second key is used to decode it. The resulting message is garbled because the key used for decoding is different from the one that encryption it. Finally, a third key is used to encrypt the garbled message. The use of multiple keys greatly reduces the chance of breaking the cipher. Triple-DES encryption is thought to be very secure, and major banks use it to transmit transactions. Unfortunately, it is also very slow. The EEE3 and EDE3 techniques are illustrated in Figure 3.5.
All private key techniques have a common problem: the more individuals who need to know the key, the greater the probability of it falling into the wrong hands. If a perpetrator discovers the key, he or she can intercept and decipher coded message. Therefore, encrypting data that are to be transmitted among large numbers of relative strangers (such as Internet transactions between businesses and customers) requires a different approach. The solution to this problem is public key encryption.
Public key encryption. Public key encryption uses two different keys: one for encoding message and the other for decoding them. Each recipient has a private key that is kept secret and a public key that is published. The sender of a message uses the receiver’s public key to encrypt the message. The receiver then uses his or her private key to encode the message. Users never need to share their private keys to decrypt messages, thus reducing the likelihood that they fall into the hands of a criminal. This approach is illustrated in Figure 3.6.
RSA (Rivest-Shamir-Adleman) is a highly secure public key cryptography method. This method is, however, computationally intensive and much slower than standard DES encryption. Sometimes, both DES and RSA are used together in what is called a digital envelope. The actual message is encrypted using DES to provide the fastest decoding. The DES private key needed to decrypt the message is encrypt using RSA and transmitted along with the message. The receiver first decodes the DES key, which is used to decode the message.
Digital Signatures
A digital signature is electronic authentication that cannot be forged. It ensures that the message or document that the sender transmitted was not tampered with after the signature was applied. Figure 3.7 illustrates this process. The sender uses a one-way hashing algorithm to calculate a digest of the text message. The digest is a mathematical value calculate from the text content of the message. The digest is then encrypted using the sender’s private key to produce the digital signature. Next, the digital signature and the text message are encrypted using the receiver’s public key and transmitted to the receiver. At the receiving end, the message is decrypted using the receiver’s private key to produce the digital signature (encrypted digest) and the cleartext version of the message. The receiver then uses the sender’s public key to decrypt the digital signal to produce the digest. Finally, the receiver recalculates the digest from the cleartext using the original hashing algorithm and compares this to the decoded digest. If the message is authentic, the two digest values will match. If even a single character of the message was changed in transmission, the digest figure will not be equal.
Digital Certificate
The aforementioned process proves that the message received was not tampered with during transmission. It does not prove, however, that the sender is who he or she claims to be. The sender could be an impersonator. Verifying the sender’s identify requires a digital certificate, which is issued by a trusted third party called a certification authority (CA). A digital certificate is used in conjunction with a public key encryption system to authenticate the sender of a message. The process for certification varies depending on the level of certification desired. It involved establishing one’s