|
|
|
|
|
|
Encryption To send confidential data or an e-mail message securely, try encrypting it. You may think it takes a lot of technical know-how, but with a little bit of effort, and some pre-arrangement with the recipients of your encoded communications, you can take advantage of this extra security measure. Hidden Text. Encrypting means to hide legible information, known as “plaintext” by converting it into "cryptotext" or "ciphertext" using cryptographic software and a code key or keys. Those with whom you want to share the encrypted information can decipher it with the appropriate key. Single (secret) key vs. double (public) key. To encrypt your private messages, files or data, you can choose a single key cryptosystem (known as symmetric, conventional or secret key) or a double key system (known as asymmetric or public key). A single key or symmetric cryptosystem is the easiest to use, because you and your recipient use the same key to encrypt and decrypt the information. But cryptographers note the "Catch-22" of such a situation: How do you send your secret key to a recipient without the rest of the world finding out, and if you encrypt your secret key to send it, how does the recipient decipher it? Public (double) key system better. Cryptographers consider the public (double) key or asymmetric encryption superior because it beats the Catch-22 of the single key system, but you do need two keys. The basic premise of double key cryptography is that one key is public and can be widely known, but the other key is secret. When you want to send an encrypted message to someone else, you must obtain and verify the recipient's public key to encrypt your plaintext, knowing that he or she has the second, associated secret key to unlock your cryptotext. PGP software a good start. For the everyday user, the easiest entry into public key encryption is with PGP (Pretty Good Privacy or Pretty Good Protection) software. PGP software is available in a variety of formats from freeware and shareware to retail products. Some PGP software may be included as a utility in e-mail management software specific to Windows, UNIX or Macintosh. To see what's available, search for “PGP” on the Internet, looking for sites where you can download or purchase PGP software or mail programs that include PGP utilities.You can also try these specific sites: download.com or freeware PGP. How it works. In very general terms, you use PGP software by generating a key pair, one public and one private. You send your public key to anyone with whom you want to share encrypted materials. That person must also be a PGP user who can send you his/her public key in return. Then you add that person's key to your public keyring for future reference and validate the other person's public key by comparing a "fingerprint" on your copy with the public one or relying on the presence of the electronic "signature." Once you have validated each other's public keys, you're ready to go. Icebergs and snake oil. But PGP is just the tip of the encryption iceberg. If you want to venture further into this vast area, you'll need to familiarize yourself with algorithms and encryption standards. Cryptography insiders tend to depend on known algorithms that have survived the test of time and are wary in general of any encryption software vendors who claim they use a new, secret algorithm. In fact, they have developed a well-known list of Frequently Asked Questions on this topic, which they call the Snake Oil FAQ. For even more information, many technical books are available on the subject, or you can search the Internet on “encryption.” |
Quick Tip The easiest entry into public key encryption is with PGP (Pretty Good Privacy or Pretty Good Protection) software. Find PGP software on the Internet in a variety of formats from freeware and shareware to commercial products |
| OIT | Office of CIO | TELR |
