Cryptosecurity

6.2.2H Standards for sharing information and communicating between browsers and servers on the Web include HTTP and secure sockets layer/transport layer security (SSL/TLS).
6.3 Cybersecurity is an important concern for the Internet and the systems built on it.
6.3.1 Identify existing cybersecurity concerns and potential options to address these issues with the Internet and the systems built on it. [P1]
6.3.1A The trust model of the Internet involves tradeoffs.
6.3.1H Cryptography is essential to many models of cybersecurity.
6.3.1I Cryptography has a mathematical foundation.
6.3.1J Open standards help ensure cryptography is secure.
6.3.1K Symmetric encryption is a method of encryption involving one key for encryption and decryption.
6.3.1L Public key encryption, which is not symmetric, is an encryption method that is widely used because of the enhanced security associated with its use.
6.3.1M Certificate authorities (CAs) issue digital certificates that validate the ownership of encrypted keys used in secured communication and are based on a trust model.

Cryptography is the study of how to convert messages into code (encryption) and how to solve codes (decryption). Just as TCP enables reliable transmission over an unreliable network, cryptography enables verifiable, secure transmission over an insecure network.

Set Up Your Headphones or Speakers
If your connection blocks YouTube, watch the video here.

Symmetric cryptography, uses the same secret key to encode and to decode a message. Symmetric cryptography has been around for thousands of years. The trouble with symmetric cryptography is: how can we keep the key secret?

Public key (asymmetric) cryptography was created by mathematicians in the 1970s. It uses two different keys for encryption and decryption, so sharing the public encryption key doesn't give away the private decryption key.

Banks use public key cryptography. When users enter their password on a bank's web site, the user's browser uses the bank's public key to encrypt the password before sending it over the Internet. Only the bank can decrypt that password, using their private key.

Secure HTTP

Secure HTTP connections (those that use https:// instead of http://) use a protocol called Transport Layer Security (TLS) or maybe an older version called Secure Sockets Layer (SSL). Both are based on public key cryptography. With SSL/TLS, the site you are visiting sends its public key, and your browser uses it to encrypt the information you send. The end of this video you've seen before describes these protocols.

If your connection blocks YouTube, watch the video here, but start it at 4:40.
Set Up Your Headphones or Speakers

Open Standards Help Security

In order to work properly, a cryptographic function has to be easy for the private key holder to invert, but hard for anyone else to invert. How do we know what "hard" means? For example, current cryptographic methods rely on the difficulty of finding prime factors of very large numbers. There's no proof that someone won't come up with a fast way to do that, but people are pretty confident about it because the problem has been well studied by many mathematicians. (On the other hand, when quantum computers become practical, factorization will be easy, and new cryptographic methods will be needed.)

What makes it possible for mathematicians to study the difficulty of breaking Internet cryptography is that the method used—the cryptographic function—is openly published. This may seem strange; if you want to keep secrets, shouldn't you keep the technique secret, too? But secret algorithms can have weaknesses that go undiscovered until some bad guy exploits them. Open standards allow an algorithm to be studied before it is used in practice.

Certificate Authorities

Public key cryptography doesn't solve all the problems, because someone might publish a fake public key pretending to be someone (say, Alice). Then someone might accidentally encrypt their message for Alice using the faker's key, and then the faker can read the message. In practice, this is partly fixed by relying on trusted third parties, called Certificate Authorities, to issue public keys. In your browser's security options you can see all of the Certificate Authorities that it trusts.

  1. Read "The Key Agreement Protocol" and "Public Keys for Private Messages" (Blown to Bits pages 181-183) for more details on Public Key Encryption.