Explaining Public Key Cryptography
This post grows out of a discussion on the Gab social media network. It is posted here to give it some permanence, as anything posted on Gab disappears under a manure pile of other posts within a few hours.
Public Key Cryptography is mathematics. Pure mathematics, and not the simple kind. It is difficult for most people to understand. This is an attempt to explain it to non-technical folks.
For centuries, encryption was what we call symmetrical. Like the Secret Decoder Rings that kids got by mail order, if you wanted to send a secret message to someone, you would write it down and then scramble the letters of the alphabet in a certain way. That "certain way" is called the key. Anyone who knows the key can use it to unscramble the letters.
The same key is used to encrypt, and decrypt the message, which is why it's called "symmetrical."
Those letter-substitution cyphers are pretty easy to break (i.e., figure out what the key is). Mary, Queen of Scots, lost her head to the executioner's axe over one that's a little more complicated than the Secret Decoder Ring (which is what the Caesars used). The Germans lost WWII over one far more complex, called "enigma," that some brilliant people at Bletchley Park in Britain managed to break.
While they were breaking the German's secret code, the same people invented a different kind of encryption. Because it was a military secret, it ended up getting invented again at MIT in 1977 because no one knew it already existed. In it, you need TWO keys, which are mathematically related: a message encrypted with one of them can ONLY be decrypted by the other.
These keys amount to two incomprehensibly large numbers, a thousand digits or more, that are generated by a process too complex to describe here, and then multiplied by each other. Knowing one of the numbers doesn't help you in figuring out what the other one is.
You keep one of those numbers a deep, dark secret. You don't even tell your own mother. You tell the other number to the whole world. The first is your private key; the second is your public key.
Your friend wants to send you a secret message. He writes it down, and then converts it, letter by letter, using your public key, and sends you the result.
The only key in the whole wide world that can decrypt that message is your private key. If you write back to your friend, you encrypt it with his public key; only his private key can decrypt it.
There is more to this - a LOT more - but we'll keep it simple here.
Obviously, all of this only works if your private key remains a secret known only to you. If anyone ever finds it, it's Game Over. All of the secret messages you have ever received become known to whomever has managed to steal, break, crack, or otherwise discover your private key.
So in the Real World, we keep our private key(s) on our personal computers, where "hackers" are known to break in and steal stuff such as your social security number. How do you keep them from stealing your private key?
You encrypt it. With an old-fashioned symmetric key (i.e., an ordinary password or "passphrase," which is a password that can have spaces in it). When you do that, it's important that you pick what we call a "strong password" that is difficult to break -- because if a "hacker" steals your encrypted private key (which, for any sufficiently skilled "hacker," is fairly easy to do) and figures out the password you used to protect it, it's still Game Over for you.
This is most of what you need to know to use the Public Key Infrastructure. To recap:
Note that this provides "medium" security; there are still ways that "hackers" can get your private key. So don't use Gab Chat to send any military secrets, corporate secrets, etc. Your love letters from your illicit lover should be safe; nobody except your spouse's lawyer will want to read those. Still, it is far, far superior to other chat systems where every message you've ever sent or received is wide open for anyone, anywhere, to read and use for blackmail.
Version number of this post, in case I revise it later:
1.1 Corrected historical detail of Mary, Queen of Scots, and minor wording changes
Public Key Cryptography is mathematics. Pure mathematics, and not the simple kind. It is difficult for most people to understand. This is an attempt to explain it to non-technical folks.
For centuries, encryption was what we call symmetrical. Like the Secret Decoder Rings that kids got by mail order, if you wanted to send a secret message to someone, you would write it down and then scramble the letters of the alphabet in a certain way. That "certain way" is called the key. Anyone who knows the key can use it to unscramble the letters.
The same key is used to encrypt, and decrypt the message, which is why it's called "symmetrical."
Those letter-substitution cyphers are pretty easy to break (i.e., figure out what the key is). Mary, Queen of Scots, lost her head to the executioner's axe over one that's a little more complicated than the Secret Decoder Ring (which is what the Caesars used). The Germans lost WWII over one far more complex, called "enigma," that some brilliant people at Bletchley Park in Britain managed to break.
While they were breaking the German's secret code, the same people invented a different kind of encryption. Because it was a military secret, it ended up getting invented again at MIT in 1977 because no one knew it already existed. In it, you need TWO keys, which are mathematically related: a message encrypted with one of them can ONLY be decrypted by the other.
These keys amount to two incomprehensibly large numbers, a thousand digits or more, that are generated by a process too complex to describe here, and then multiplied by each other. Knowing one of the numbers doesn't help you in figuring out what the other one is.
You keep one of those numbers a deep, dark secret. You don't even tell your own mother. You tell the other number to the whole world. The first is your private key; the second is your public key.
Your friend wants to send you a secret message. He writes it down, and then converts it, letter by letter, using your public key, and sends you the result.
The only key in the whole wide world that can decrypt that message is your private key. If you write back to your friend, you encrypt it with his public key; only his private key can decrypt it.
There is more to this - a LOT more - but we'll keep it simple here.
Obviously, all of this only works if your private key remains a secret known only to you. If anyone ever finds it, it's Game Over. All of the secret messages you have ever received become known to whomever has managed to steal, break, crack, or otherwise discover your private key.
So in the Real World, we keep our private key(s) on our personal computers, where "hackers" are known to break in and steal stuff such as your social security number. How do you keep them from stealing your private key?
You encrypt it. With an old-fashioned symmetric key (i.e., an ordinary password or "passphrase," which is a password that can have spaces in it). When you do that, it's important that you pick what we call a "strong password" that is difficult to break -- because if a "hacker" steals your encrypted private key (which, for any sufficiently skilled "hacker," is fairly easy to do) and figures out the password you used to protect it, it's still Game Over for you.
This is most of what you need to know to use the Public Key Infrastructure. To recap:
- Generate your own personal keypair on your computer, using software that does that for you.
- Keep your private key a secret by encrypting it with a password. NEVER store the actual private key on your hard drive; only the encrypted version.
- Tell your public key to the whole world so that anyone who wants to, can send you a secret message.
Note that this provides "medium" security; there are still ways that "hackers" can get your private key. So don't use Gab Chat to send any military secrets, corporate secrets, etc. Your love letters from your illicit lover should be safe; nobody except your spouse's lawyer will want to read those. Still, it is far, far superior to other chat systems where every message you've ever sent or received is wide open for anyone, anywhere, to read and use for blackmail.
Version number of this post, in case I revise it later:
1.1 Corrected historical detail of Mary, Queen of Scots, and minor wording changes
posted by Ken | 11:49 AM
2 Comments:
Damn Ken, I forgot about your blog and only discovered it during some housecleaning of my old laptop. I remember using PGP back in the day, does it still exist?
Anyway, I'm glad to see you are still ranting, I'll have to check in more often!
Cheers,
Dave Wise
I'm not sure if my last post was received, but if it wasn't, just saying I had forgotten about your blog and it is good to see you still have that fire in the belly.
Dave
Post a Comment
<< Home