Asymmetric Encryption

Asymmetric encryption or public key cryptography is unlike symmetric encryption, in that it uses two unique keys, as shown in Figure 11.3. One key is used to encrypt the data, and the other is used to decrypt it. One of the greatest things about asymmetric encryption is that it overcomes one of the big barriers of symmetric encryption: key distribution.

Figure 11.3. Asymmetric encryption.

Here's how asymmetric encryptions: Imagine that you want to send a client a message. You use your client's public key to encrypt the message. When your client receives the message, he uses his private key to decrypt it. The important concepts here are that if the message is encrypted with the public key, only the matching private key will decrypt it. The private key is generally kept secret, whereas the public key can be given to anyone. If properly designed, it should not be possible for someone to easily deduce the private key of a pair if that person has only the public key.

Public key cryptography is made possible by the use of one-way functions. A one-way function, or trap door, is a math operation that is easy to compute in one direction, yet next to impossible to compute in the other. Depending on what type of asymmetric encryption used, this difficulty is based on either the discrete logarithm problem or the factoring of a large number into the prime number used. As an example, it you are given two large prime numbers, it is easy to multiply them. However, if you are given only their product, it difficult or impossible to find the factors with today's processing power.

The trap door function allows someone with the public key to reconstruct the private key if he knows the trap door value. Therefore, anyone who knows the trap door can perform the function easily in both directions, but anyone lacking the trap door can perform the function only in one direction. The forward direction is used for encryption and signature verification, and the inverse or backward direction is used for decryption and signature generation. We have people like Dr. W. Diffie and Dr. M. E. Hellman to thank for helping develop public key encryption; they released the first key-exchange protocol in 1976.

RSA

RSA was developed in 1977 by Ron Rivest, Adi Shamir, and Len Adleman at MIT. The name is based on their initials. Although RSA is much slower than symmetric encryption cryptosystems, it offers secure key exchange and is considered very secure. Cryptanalysts or anyone attempting to crack RSA would be left with a difficult challenge because of the difficulty of factoring a large integer into its two factors. Cracking the key would require an extraordinary amount of computer processing power and time. RSA supports a key size up to 2040 bits.

The RSA algorithm has become the de facto standard for industrial-strength encryption, especially since the patent expired in 2000. It is built into many protocols, software products, and systems such as Microsoft Internet Explorer and Firefox.

Diffie-Hellman

Diffie-Hellman was the first public key-exchange algorithms. It was developed for key exchange, not for data encryption of digital signatures. The Diffie-Hellman protocol allows two users to exchange a secret key over an insecure medium without any prior secrets. It's vulnerable to man-in-the-middle attacks because the key exchange does not authenticate the participants. To alleviate this vulnerability, digital signatures should be used. Diffie-Hellman is used in conjunction with several authentication methods, including the Internet Key Exchange (IKE) component of IPSec.

El Gamal

El Gamal is an extension of the Diffie-Hellman key exchange. It can be used for digital signatures, key exchange, and encryption. El Gamal consists of three discrete components, including a key generator, an encryption algorithm, and a decryption algorithm. It was released in 1985, and its security rests in part on the difficulty of solving the discrete logarithm problems.

Elliptical Curve Cryptosystem (ECC)

Although it is not as fast as the previous mentioned systems, it is considered more secure because elliptic curve systems are harder to crack than those based on discrete log problems. ECC is being implemented in smaller, less powerful devices, such as cellphones and handheld devices.

Merkle-Hellman Knapsack

This asymmetric algorithm is based on fixed weights. Although this system was popular for a while, it has fallen from favor because it was broken in 1982.

Before attempting the exam, it is prudent that you know what categories each of the asymmetric algorithms discussed fits into. The following shows how each functions:

• Functions by using a discreet logarithm in a finite field
  • Diffie-Hellman
  • El Gamal
  • Elliptical Curve Cryptosystem
• Functions by the product of large prime numbers
  • RSA
• Functions by means of fixed weights
  • Merkle-Hellman Knapsack