50
780
Security
Chapter 21
© Copyright 1992–2002 by Deitel & Associates, Inc. All Rights Reserved. 8/29/01
cryptosystem—a mathematical algorithm for encrypting messages (algorithm is a computer
science term for “procedure”). A key—a string of digits that acts as a password—is input
to the cipher. The cipher uses the key to make data incomprehensible to all but the sender
and intended receivers. Unencrypted data is called plaintext; encrypted data is called ci-
phertext. The algorithm is responsible for encrypting data, while the key acts as a vari-
able—using different keys results in different ciphertext. Only the intended receivers
should have the corresponding key to decrypt the ciphertext into plaintext.
Cryptographic ciphers have been used throughout history, first recorded by the ancient
Egyptians, to conceal and protect valuable information. In ancient cryptography, messages
were encrypted by hand, usually with a method based on the alphabetic letters of the mes-
sage. The two main types of ciphers were substitution ciphers and transposition ciphers. In
a substitution cipher, every occurrence of a given letter is replaced by a different letter; for
example, if every “a” is replaced by a “b,” every “b” by a “c,” etc., the word “security”
would encrypt to “tfdvsjuz.” The first prominent substitution cipher was credited to Julius
Caesar, and is referred to today as the Caesar Cipher. Using the Caesar Cipher, every
instance of a letter is encrypted by replacing by the letter in the alphabet three places to the
right. For example, using the Caesar Cipher, the word “security” would encrypt to “vhfx-
ulwb.”
In a transposition cipher, the ordering of the letters is shifted; for example, if every
other letter, starting with “s,” in the word “security” creates the first word in the ciphertext
and the remaining letters create the second word in the ciphertext, the word “security”
would encrypt to “scrt euiy.” Complicated ciphers combine substitution and transposition
ciphers. For example, using the substitution cipher first, followed by the transposition
cipher, the word “security” would encrypt to “tdsu fvjz.” The problem with many historical
ciphers is that their security relied on the sender and receiver to remember the encryption
algorithm and keep it secret. Such algorithms are called restricted algorithms. Restricted
algorithms are not feasible to implement among a large group of people. Imagine if the
security of U.S. government communications relied on every U.S. government employee
to keep a secret; the encryption algorithm could easily be compromised.
Modern cryptosystems are digital. Their algorithms are based on the individual bits or
blocks (a group of bits) of a message, rather than letters of the alphabet. A computer stores
data as a binary string, which is a sequence of ones and zeros. Each digit in the sequence
is called a bit. Encryption and decryption keys are binary strings with a given key length.
For example, 128-bit encryption systems have a key length of 128 bits. Longer keys have
stronger encryption; it takes more time and computing power to crack the message.
Until January 2000, the U.S. government placed restrictions on the strength of crypto-
systems that could be exported from the United States by limiting the key length of the
encryption algorithms. Today, the regulations on exporting products that employ cryptog-
raphy are less stringent. Any cryptography product may be exported as long as the end user
is not a foreign government or from a country with embargo restrictions on it.
3
21.3 Secret-key Cryptography
In the past, organizations wishing to maintain a secure computing environment used sym-
metric cryptography, also known as secret-key cryptography. Secret-key cryptography
uses the same secret key to encrypt and decrypt a message (Fig. 21.1). In this case, the send-
pythonhtp1_21.fm Page 780 Wednesday, August 29, 2001 4:16 PM
