|
With the increasing incidence of identity thefts, credit card frauds, social
engineering attacks, the digital world is facing challenges in the years ahead.
Obviously, cryptography, a young science, will play a prominent role in the
security of protecting digital assets. This article tries to explain the basics
of cryptography (encryption) using plain language.
Let us take the example of scrambling an egg. First, crack the shell, pour
the contents into a bowl and beat the contents vigorously until you achieved
the needed result - well, a scrambled egg. This action of mixing the molecules
of the egg is encryption. Since the molecules are mixed-up, we say the egg has
achieved a higher state of entropy (state of randomness). To return the scrambled
egg to its original form (including uncracking the shell) is decryption. Impossible?
However, if we substitute the word “egg” and replace it with “number”,
“molecules” with “digits”, it is POSSIBLE. This, my friend,
is the exciting world of cryptography (crypto for short). It is a new field
dominated by talented mathematicians who uses vocabulary like "non-linear
polynomial relations", "overdefined systems of multivariate polynomial
equations", "Galois fields", and so forth. These cryptographers
uses language that mere mortals like us cannot pretend to understand.
In the computer, everything stored are numbers. Your MP3 file is a number.
Your text message is a number. Your address book is a longer number. The number
65 represents the character "A", 97 for the small "a", and
so on.
For humans, we recognize numbers with the digits from 0 to 9, where else, the
computer can only recognize 0 or 1. This is the binary system which uses bits
instead of digits. To convert bits to digits, just simply multiply the number
of bits by 0.3 to get a good estimation. For example, if you have 256-bits of
Indonesian Rupiah (one of the lowest currency denomination in the world), Bill
Gates’ wealth in comparison would be microscopic.
The hexadecimal (base 16) system uses the ten digits from 0 to 9, plus the
six extra symbols from A to F. This set has sixteen different “digits”,
hence the hexadecimal name. This notation is useful for computer workers to
peek into the "real contents" stored by the computer. Alternatively,
treat these different number systems as currencies, be it Euro, Swiss Franc,
British Pound and the like. Just like an object can be priced with different
values using these currencies, a number can also be "priced" in these
different number systems as well.
To digress a bit, have you ever wondered why you had to study prime numbers
in school? I am sure most mathematics teachers do not know this answer. Answer:
A subbranch called public-key cryptography which uses prime numbers especially
for encrypting e-mails. Over there, they are talking of even bigger numbers
like 2048, 4096, 8192 bits.)
When we want to encrypt something, we need to use a cipher. A cipher is just
an algorithm similar to a recipe for baking a cake. It has precise, unambiguous
steps. To carry out the encryption process, you need a key (some called it passphrase).
A good practice in cryptography needs the key used by a cipher must be of high
entropy to be effective.
Data Encryption Standard (DES), introduced as a standard in the late 1970's,
was the most commonly used cipher in the 1980's and early 1990's. It uses a
56-bit key. It was broken in the late 1990’s with specialized computers
costing about US$250,000 in 56 hours. With today's (2005) hardware, it is possible
to crack within a day.
Subsequently, Triple-DES superseded DES as the logical way to preserve compatibility
with earlier investments by big corporations (mainly banks). It uses two 56-bit
key using three steps:-
1. Encrypt with Key 1.
2. Decrypt with Key 2.
3. Encrypt with Key 1.
The effective key length used is only 112-bits (equivalent to 34 digits). The
key is any number between 0 and 5192296858534827628530496329220095. Some modify
the last process using Key 3, making it more effective at 168-bit keys.
Advanced Encryption Standard (AES) was adopted as a standard by the National
Institute of Standards & Technology, U.S.A. (NIST) in 2001. AES is based
on the Rijndael (pronounced "rhine-doll") cipher developed by two
Belgian cryptographers, Victor Rijmen and Joan Daemen. Typically, AES uses 256-bits
(equivalent to 78 digits) for its keys. The key is any number between 0 and
15792089237316195423570985008687907853269984665640564039457584007913129639935.
This number is the same as the estimated number of atoms in the universe.
The National Security Agency (NSA) approved AES in June 2003 for protecting
top-level secrets within US governmental agencies (of course subject to their
approval of the implementation methods). They are reputedly the ones that can
eavesdrop on all telephone conversations going on around the world. Besides,
this organization is recognized to be the largest employer of mathematicians
in the world and may be the largest buyer of computer hardware in the world.
The NSA probably have cryptographic expertise many years ahead of the public
and can undoubtedly break many of the systems used in practice. For reasons
of national security, almost all information about the NSA - even its budget
is classified.
A brute force attack is basically to use all possible combinations in trying
to decrypt encrypted materials.
A dictionary attack usually refers to text-based passphrases (passwords) by
using commonly used passwords. The total number of commonly used passwords is
surprisingly small, in computer terms.
An adversary is somebody, be it an individual, company, business rival, enemy,
traitor or governmental agency who would probably gain by having access to your
encrypted secrets. A determined adversary is one with more "brains"
and resources. The best form of security is to have zero adversary (practically
impossible to achieve), the next best is to have zero determined adversary!
A keylogger is a software program or hardware to capture all keystrokes typed.
This is by far the most effective mechanism to crack password-based implementations
of cryptosystems. Software keylogger programs are more common because they are
small, work in stealth-mode and easily downloaded from the internet. Advanced
keyloggers have the ability to run silently on a target machine and remotely
deliver the recorded information to the user who introduced this covert monitoring
session. Keystroke monitoring, as everything else created by man, can either
be useful or harmful, depending on the monitor’s intents. All confidential
information which passes through the keyboard and reaches the computer includes
all passwords, usernames, identification data, credit card details, and confidential
documents (as they are typed).
For the last definition, we will use an example. Let's say you have your house
equipped with the latest locks, no master keys and no locksmith can tamper with
them. Your doors and windows are unbreakable. How then does an adversary get
into your house without using a bulldozer to break your front door? Answer:
the roof - by removing a few tiles, the adversary can get into your house. This
is an exploit (weakness point). Every system, organization, individual has exploits.
See, it is not that difficult after all. If you can understand the material
presented in this article, congratulations - you have become crypto-literate
(less than 1% of all current computer users). If you do not believe me, try
using some of this newfound knowledge on your banker friends or computer professionals.
Stan Seecrets’ Postulate: “The sum total of all human knowledge is
a prime number.”
Corollary: “The sum total of all human wisdom is not a prime number.”
This article may be freely reprinted providing it is published in its entirety,
including the author’s bio and link to the URL below.
About the Author:
The author, Stan Seecrets, is a veteran software developer with 25+ years experience
at (http://www.seecrets.biz) which specializes in protecting digital assets.
This site provides quality software priced like books, free-reprint articles
on stock charts and computer security, free downloads and numerous free stuff.
© Copyright 2005, Stan Seecrets. All rights reserved. |
