Encryption

From RationalWiki
Jump to: navigation, search

Encryption is a method of protecting data or messages in transit. In the event that the storage for that information is copied or stolen, it is generally expected that the content itself isn't likely to be retrieved within a reasonable amount of time.

Contents

[edit] Types

Generally encryption algorithms can be divided into two types:

  1. Symmetrical: The same key is used to encrypt and decrypt data (examples: RC4, Blowfish, 3DES)
  2. Asymmetrical: A key pair is created (public and private keys), and data encrypted with one key can only be decrypted with the corresponding key in the key pair (examples: RSA, Diffie–Hellman, elliptic curve)

While symmetrical algorithms tend to be faster, they require a preshared key and therefore are unsuitable for encryption in situations where keys cannot be exchanged securely (such as the internet). In TLS/SSL the data is encrypted with a symmetrical key, which itself is encrypted using the webserver's public key. The ciphertext and encrypted key are then sent to the server, where the server then decrypts the key using its private key, and then uses the decrypted key to decrypt the ciphertext, and the same key is used to encrypt the server's response.

[edit] Weaknesses

Depending on the method chosen, encryption has shortcomings[1] as an infallible security system:

  • Plaintext analysis, which uses known plaintext patterns to help decode the message (e.g. substitution ciphers are subject to frequency analysis)
  • Exhaustive key search or "brute force", which goes through every combination of keys possible to decode a message[2]. Most modern algorithms tend to avoid using too weak of a key. Where the password used is user-generated, key searches usually start with a dictionary attack (using a large list of common passwords or phrases), followed by a hybrid attack (using the same dictionary but adding numbers, changing letter cases, or substituting letters for numbers, e.g. rationalwiki => r4t10n4lw1k1), and then a brute force attack.
  • Mathematical analysis, designed to find efficient methods to crack the encryption.
  • Duress, which involves using a rubber hose on a person's feet. Despite protection provided by encryption, the key can be extracted from someone who is willing to cooperate to avoid torture (or for cookies). Some encryption systems use plausible deniability methods (such as an encrypted partition within an encrypted partition) to hide the real data when forced to reveal the key under duress[3]
  • Theft, either by malware/key-logger, phishing, or by just plain real-life robbery. This is usually the most reliable option to break a secure system, and the one that anyone looking to decrypt a system, whether it be a hacker in Russia or the FBI, uses most often.

[edit] Responses to cryptography

Governments have differing responses to cryptography.

  • The USA treats some encryption systems (such as those supporting key sizes above 128 bits) to be equivalent of "weapon-grade" cryptography (it is quite literally regulated by the Arms Control Export Act), and restricts their export. However, every U.S. citizen is permitted to utilize and possess cryptographic methods/implementation of any key size (provided they do not pass the technology to foreigners).
  • Some governments allow cryptography, and sometimes mandate that it be used to protect sensitive customer and research information. They may also make it illegal to use it for criminal purposes.
  • The United Kingdom passed the Regulation of Investigatory Powers Act 2000, which allows the government to demand keys from individuals, and refusal to do so can lead to a custodial sentence[4]. Other governments demand a key escrow.

[edit] Footnotes

  1. Elvidence - Encryption: Protecting the Information
  2. TechTarget - Brute force cracking
  3. TrueCrypt - Plausible Deniability
  4. BBC News - Man jailed over computer password refusal
Personal tools
Namespaces

Variants
Actions
Navigation
Community
Tools
support