************************************* * * * DB/C Newsletter * * December 1995 * * * ************************************* Editor's Notes If you are reading this newsletter through the WWW server at www.swc.com, you may be unaware that you can receive each DB/C Newsletter via email. To have future issues emailed directly to you, you can subscribe by sending a message to 'majordomo@swc.com' and in the body of the email message put this line 'subscribe dbcnews' (in both cases omit the ' characters). While you are surfing the web, check out the following interesting WWW sites. For those of you who are interested in computer graphics, or if you happen to be younger than 10 years of age, surf on over to the WWW site for the movie 'Toy Story'. The address is http://www.toystory.com. Another site that can give you a good feeling for the size and scope of the Internet is the DejaNews Research Service site. The address is http://dejanews.com. DejaNews is a database of USENET postings of the last 6 months. DejaNews allows you to search the database using any word or word combination. The result is a list of USENET messages that meet or come close to the word combination you specified. A click on the list brings up the actual USENET posting. The issue of privacy (or the lack thereof) is highlighted by the DejaNews service. I have seen the term 'data mining' used recently to describe what some software does to accumulate information about people, places and things. With access to databases like DejaNews, a 'data miner' could figure out your hobbies, your business interests, your politics - in fact, just about everything about your life. And worse, if someone decided to impersonate you - major harm to your reputation or finances could occur. As usual, problems created by technology can be solved by technology. Encryption software can be used to keep private communications really private. And authentication software can be used to make sure that the person at the other end of a cyberspace email message or business transaction is really who you think it is. Many people have little understanding of the issues and capabilities of today's encryption software. Hopefully, the article in this month's newsletter will help to introduce you to the terminology and the capabilities of today's software systems. There is a political aspect to privacy issue that I will mention here. Since World War II, the US government has forbidden the export of software or other devices that implement strong encryption. This has caused software vendors to create two versions of their products - one for use inside the US and another for export. Netscape Navigator and Lotus Notes are two examples of software products that have a US only version with strong encryption and an exportable version with weak encryption. It is perfectly legal (at least as far as US laws are concerned) for a person or company to create software containing strong encryption outside of the US and ship it back into the US. But that software can't then be taken back out of the US. In my opinion, the prohibition of export of strong encryption software needs to be removed so that people and businesses can be free to send private communications on public data networks without fear that their data might be compromised or publicized. For those who are waiting for the release of DB/C 9, we appreciate your patience. Details of the final release of DB/C 9 will be published in our January 1996 DB/C Newsletter. Happy holidays! don.wills@swc.com Encryption and Authentication Encryption and authentication are usually discussed together. They are similar in some technical aspects, but each provides a very different service. Encryption is the process of converting a message or data into a form that is not understandable by others. Decryption is the process of converting an encrypted message or encrypted data back to the original message or data. Authentication is the process of adding an unforgeable signature to a message or data. This provides the receiver with an assurance that the message or data is authentic. Authentication can also provide the receiver with the assurance that a message has not been altered during transmission. Encryption and authentication can be used separately or together. When used together, the sender of a message can be assured that the content is secure and the receiver of a message can be assured that the message is authentic. There are many algorithms used for encryption and authentication. Most algorithms are based either on private keys or on public keys. A private key system is one in which both the sender and the receiver need to protect their keys from being found out. This method is inconvenient unless the parties can physically communicate keys without fear of their being compromised. Public key algorithms solve the problems of key distribution and key management. They work like this: A person who wants to receive messages (the receiver) generates two keys - the encryption key and the decryption key. The receiver then sends the encryption key to all parties who want to send messages (senders) to the receiver. When a sender wants to send a message, he uses the encryption key to convert the message into an encrypted message. This message is then sent to the receiver who uses the decryption key to decode the message. In public key systems, there is no need for private communication of keys - the only key that needs to be safeguarded is the receiver's key - and he was the person who created it - so it never needs to move. Authentication uses a similar approach, except that the sender, not the receiver, creates the encryption and decryption keys. When a sender wants to send a message, he uses the encryption key to convert the message before transmission. The sender sends the message to the receiver. The receiver then uses the decryption key to prove that the message came from the person who owns the encryption key that matches. The algorithm works in such a way that the only person who could have created the message was someone who knew the encryption key - which in this case was the sender. Again, there is no need for private communication of keys - the only key that needs to be safeguarded is the sender's key - and he was the person who created it. It gets complicated, but both methods can be employed simultaneously. When used together, public key encryption and authentication systems can guarantee that a message came from a specific sender, that it was not altered during transmission, and that the message was secure from anybody else finding out its content. The oldest and most widely used encryption method using a private key algorithm is called the Data Encryption Standard (DES). The DES was adopted as official FIPS and ANSI standards in the late 1970's. (ISO is not involved in the standardization of cryptography.) In DES, the same key is used for both encryption and decryption. One of the limitations of DES is that the secrecy of a message can be compromised if the key is too small. Most DES systems in use today use a key that is 56 bits long. Without knowing the key, very fast computer systems can decipher a message that is encrypted with DES using a 56 bit key. Key lengths longer than 56 bits are not generally used because export from the US of DES encryption software using longer key lengths is prohibited by US law (see above). The most widely used public key encryption systems are based on an algorithm called the RSA algorithm. The RSA algorithm, named for its inventors Ron Rivest, Adi Shamir and Leonard Adleman, was introduced in 1978. The RSA algorithm's security is based on the assumption that it is a very hard problem to factor very large numbers (e.g. numbers with 200 digits) that have only two prime factors (each factor is a number with 100 digits). In this context, the term 'a very hard problem' means that such a number could only be factored by a network of one million of the fastest computers available today working continuously for 4000 years. Thus, using today's technology, the RSA algorithm is practically unbreakable. Unfortunately, the RSA algorithm is anywhere from 100 to 1000 times slower than DES. Because of the slowness of RSA, many products (such as Netscape Navigator and others) use a combination of RSA and other algorithms. These encryption systems work by sending DES keys encrypted with RSA and then sending the actual messages encrypted with DES. For those who are interested in finding out more about this subject, I highly recommend the book 'Applied Cryptography' by Bruce Schneier. It is the authoritative reference for encryption and authentication. DB/C Class Schedule The next DB/C class will be held the week of February 5, 1996. Exact time and location will be announced in the January 1996 DB/C Newsletter.