Book IV 5 in Java

Encoding QR in Java Book IV 5

Public key #1

Ciphertext Figure 5-5: Ciphertext Public keys encrypt data, and private keys decrypt data Plaintext

Private key #1

Public key encryption is commonly used in digital signatures to verify who actually sent an encrypted message When you encrypt a message with your private key, that message can be decrypted only with your public key Because you re the only person with a copy of your private key, the only possible way a message can be decrypted with your public key is if it was originally encrypted with your private key (Unless, of course, someone steals your private key In that case, he can mimic you online) Public key and private key encryption is commonly used together in programs, such as Pretty Good Privacy (PGP), which are designed for sending encrypted messages First, you encrypt your message with private key encryption Then you use public key encryption to send the password (private key) to another person The receiver unlocks the password using her private key and then uses this password to unlock the actual message, as shown in Figure 5-6 The reason for using both private key and public key encryption is that public key encryption tends to run much slower than private key encryption That s because with public key encryption, you need to encrypt data using the combination of the sender s private key with the receiver s public key With private key encryption, you need only one key to encrypt data Public key encryption is used in SSL (Secure Sockets Layer), which is how you can connect to a secure shopping Web site and safely transfer your credit card numbers over the Internet The shopping Web site basically gives your computer its public key so you can encrypt your credit card number and send it over the Internet Now the only one who can decrypt your credit card number is the shopping Web site holding the private key

Public key decryption Figure 5-6: Public key and private key encryption can work together Private key decryption

Encryption works by scrambling data, but anything scrambled can always be unscrambled What makes the difference between strong and weak encryption is how many possible ways exist to unscramble the encrypted data If only ten possible ways exist to scramble data, that s much easier to crack than a message that offers ten million different ways to scramble data To unscramble data that offers ten possible ways of scrambling a message, you can just use a brute force attack

One unusual form of encryption involves hiding data within another chunk of data, such as hiding a text message inside an audio or graphic image Hiding data within another form of data is steganography The idea is that no one can read your messages if he can t find them in the first place Steganography works on the principle that data in audio, video, and graphic files can be removed without noticeably affecting the quality of the original file After removing chunks of information from such a file, which leaves gaps in the original file, the next step is to insert the plaintext or ciphertext into these open gaps If you insert plaintext into an audio, video, or graphic file, anyone can read your message if he knows how to find it If you encrypt your message and then insert the ciphertext into a file, someone would need to know where to find your message and then know the password to decrypt that message Steganography isn t necessarily a form of encryption so much as it s a way to keep anyone from knowing you re sending secret messages at all

Basically, a brute force attack tries every possible combination of ways a message can be scrambled Think of a combination lock that opens only if you align the right number If the combination lock offers 36 numbers, you can use a brute force attack and exhaustively try all 36 numbers until you find the one that opens the lock Now consider a more complicated combination lock that not only displays 36 numbers but forces you to choose three different numbers in the correct order You can still exhaustively try every possible number combination, but the time needed to do this is likely more than most people are willing to take, which effectively makes the lock secure That s the same idea behind encryption Every form of encryption can eventually be cracked with a brute force attack, but the time needed to exhaustively try every possibility takes too much time It s possible to crack even the toughest encryption algorithm with a brute force attack, but you might need a room full of million-dollar supercomputers running 24 hours a day for the next million years to eventually crack the encryption By making the costs in resources and time too high, encryption algorithms are essentially unbreakable through a brute force attack alone A variation of the brute force attack is the Chinese lottery The idea is that if you gave each person in China (with its billion+ population) a computer and assigned each computer a different range of brute force attacks on the same encrypted data, eventually one of them will crack the encryption and hence win the lottery