Cryptology and Data Security

When an email application is used, the emails are sent in plain text (readable text) over the network, from source user to the target user. If a third person desires to know the content of the email it is enough to intercept this email that is sent over the network, to read it and if he wants to store it on the hard disk.

These can be fulfilled using some software that can be downloaded from Internet. Some of this kind of software is for free, some others are created by specialized companies and they could be used for free during the trail period; after this trail period these can be bought for a relatively small amount of money from the companies that produced them.

This kind of software is called sniffer and it is used to analyze the data that flows in the computer networks. This software that monitors the network could be installed on some computers in a network, and they can be configured to analyze the data that pass through the node where they are installed.

If the two email users want to communicate in a network where a third person uses such software, the email can be intercepted and presented in a readable form by the sniffer application. These interceptions can occur no matter the configuration of the email application or some other protection software that is used by the two users involved in the communication. These interceptions can be done as long as the emails are sent over the network in plain text.

Image 1 presents an interface that can be used to send email, the one provided by Yahoo email service.

Image 1

Image 2 presents the interface of the application where a third person can see the sent email. The selected area is the text written in the email interface (Image 1) by the user that sends the email.

Image 2

The presented situation is a particular case of the more general situation where any two users communicate by any kind of program over an insecure environment, where a third user wants to intercept the information that is sent between the two. For this kind of situations, there were attempts to find methods to secure the transmission of the information between the two involved parts.

This need for securing the information was felt since long time ago. The first known crypto-system was used during Caesar time (almost 2000 years before). The system was based on the replace of each letter in the alphabet with the letter that is three positions after it. More details about cryptology history can be found in the internet (ex: http://www.cse-cst.gc.ca/documents/about-cse/museum.pdf)

These methods evolved during the lapse of time, and today they form a science called cryptology. This science is based on some elements in mathematical theory where is demonstrated the computational impossibility to decipher the messages ciphered using some studied algorithms (current computers are not powerful enough to decipher the text in a reasonable time, if some conditions are met when the text is ciphered).

Using these crypto mechanisms the two users that communicates over the Internet can cipher the content of the messages they sent. Doing so, even if a third person who uses a sniffer intercepts these messages, he will not be able to understand them, because these messages do not contain readable text.

In order to cipher the sent messages, these cryptographic algorithms take as input the readable text and as output they return the ciphered text.

These algorithms are not some secret algorithms, because if they were, it would not be possible to be used at a large scale and by persons that do not know each others. Because they are not secret there must by something that can assure the protection of the text if an unauthorized person obtains both the ciphered text and the algorithm that encrypts the text.

These algorithms use keys to encrypt the text. A key is a series of numbers (or letters and numbers) which is combined with the readable text and results the encrypted text (the combination is done by the cryptographic algorithm).

These keys are the elements that must be kept secret, in order to assure the protection (privacy) of the text.

The possibilities to decrypt an encrypted text are either to find an exploit (error) in the cryptographic algorithm or to find out a key (which is not always the same key used when the text was encrypted). The chances to discover and use weaknesses from the cryptographic algorithms are very small.

A possibility to decrypt the text could be to look for and check all the possible keys (this procedure is known as brute force). Since longer keys require more work to brute force search, a long enough key will require more work than is feasible. Thus, length of the key is important in resisting this type of attack.

With a key of length n bits, there are 2ⁿ possible keys. This number grows extremely rapidly as n increases. Some studies (Moore's law) suggest that computing power doubles roughly every 18 months. But even considering this doubling effect, for a key length big enough, the possibility to discover the key is very small at a feasible time and cost.

The RSA algorithm is one of the most known algorithms used to encrypt texts. The 512 bits RSA key was broken in 1999 by a computer that was the equivalent of 300 PCs averaging 400 MHz and each with at least of 64 Mbytes of RAM. This computer ran for 2 moths and 10 days to break the key.

Considering these results and making some calculations (see www.rsa.com), there would be necessary 1.4 billion 500 MHz computers each one having 170 Gbytes of memory and running in parallel for 2 moths and 10 days to break the 1024 bits RSA key. The cost of the attack will exceed the economic gain that might be derived from breaking the key. Until now there are no public records about the success of breaking of the 1024 bits RSA key.