May 28, 1998

From Toy Rings to Sophisticated Codes, a Quest for Secrecy

By PETER WAYNER

f philosophers taught a class on encryption, they would probably begin by saying: "Before we ask what encryption is, we must wonder, What is secrecy? What is disclosure? What is information? What is deception? Ultimately we must truly ponder whether the true nature of human existence is to communicate or miscommunicate."

Related Articles How Encryption Works Secrets Kept and Found: An Encryption Timeline

While it may be unfair to parody philosophers in this way, there is little doubt that the definition of encryption is caught up in the murky depths of knowledge and language. Encryption, or cryptology, is the science of designing code techniques so people can make information unreadable to all but the intended recipients.

Many people's first introduction to the topic were the toy decoder rings that used to be found in cereal boxes.

The code rings imitate a system that dates from the time of Caesar. It simply replaces each letter with another letter three or four places down the alphabet.

"A" becomes "D," "B" becomes "E" and so on.

That is easy to figure out, but everything becomes complicated after that.

The philosophical problems with encryption are debated today at the highest levels of Government, largely because the prevalence of computers lets almost anyone use sophisticated encoding systems.

Louis J. Freeh, Director of the Federal Bureau of Investigation, for instance, places certain kinds of encryption at the top of the list of things that threaten the ability of his agents to do their jobs. He says criminals will be able to use fast computerized codes to keep law-enforcement officers from gathering evidence. The topic is debated because others say that encryption is their one hope for protecting their industrial secrets from spies, their children's E-mail from stalkers and their credit card numbers from thieves.

A bill passed by the House Intelligence Committee last year would ban any device used to make messages secret. Critics say that, in theory, such a law might apply to new computer software, to the signals used by baseball managers and perhaps even less common languages like Navajo. Puns, double-entendres and the code words used by politicians could also be suspect, at least to some people.

The approach of the proposed legislation suggests that the Government needs to be able to read everything being said. No further action was taken on the proposal, but it may re-emerge this year. The Justice Department continues to be actively concerned about any communication system it cannot intercept.

For most people today, the practical question is simply what software can be used to scramble messages reliably so they cannot be read by thieves, stalkers, nosy neighbors, little brothers and the person in the next cubicle.

The problem with trying to explain encryption is that the techniques that work are very sophisticated. So sophisticated in fact that one way of thinking about encryption is that it involves math problems that can be done forward but not backward. In other words, encryption has to operate on a kind of mathematical frontier. If the methods and problems were well understood, the codes would easy to break.

At the center of every encryption system is a secret number or mathematical operation, metaphorically referred to as a key. With the toy decoder ring, the key might be the number 3, representing how far down the alphabet to shift the letters. In modern encryption systems, keys are often very large numbers. The mathematical formula for encoding a message -- which determines how the key is used -- is called an algorithm. For the decoder ring, the algorithm tells you to move a certain number of letters.

One of the most popular algorithms is known as D.E.S., for Data Encryption Standard. It was developed in the 1970's by International Business Machines with some assistance from the National Security Agency. While some people worried that the Government had introduced hidden weaknesses that could later be used to decode messages, none have been found.

D.E.S. is a good method, but it is getting old.

Its keys are 7 bytes (56 bits) long. (A bit, in computer memory, is a 1 or a 0.) In the last year, large groups of people have used spare time on their computers to try to decode one particular message by testing all possible combinations of 56 1's and 0's, a value that is around 50 quadrillion, to find that message's key. The contest was set up by an encryption software company as a quasi lottery that rewarded the lucky person with the answer with a $1,000 check.

One way to protect a message is to encrypt it with D.E.S. three times, using three different keys. That would seem to make an attack based upon the brute force of high-powered computing practically impossible, although recent results show that even this assumption might be suspect. Some other ways to achieve complete security include similar algorithms that use substantially longer keys to prevent attack. Some popular names include RC-4, IDEA and Blowfish.

Each of these algorithms is sometimes called a secret-key algorithm or a symmetric algorithm because both the sender and the receiver must agree upon the same key and keep it secret.

Another important technology, developed in the 1970's, is known as public key cryptography. It gets its name because each person has two keys and makes one of them public. Once a message has been encrypted with a public key, only the corresponding private key can decode it. The two keys in the system often confuse people who imagine that the keys work like the double keys in safe deposit boxes. There is no easy physical analogy for the system.

Public key encryption is popular because it makes it relatively easy to distribute keys. Anyone using a public key can just post it on the Web; several public key servers are already available.

Some of the leading encryption software vendors today are PGP, RSA Data Securities and Entrust. Many other companies offer products that interact with your E-mail program and make it easier to communicate in private. Some products, like Lotus Notes, offer built-in encryption as a feature.

Most of the practical algorithms have one fundamental problem: there is no way to prove that they really are secure. A math genius may find a way to break the codes. One may already have done so and kept the knowledge secret in order to exploit it.

That brings the topic back to the misty depths of philosophy and the limits of logical thought. Edgar Allan Poe once said that there was no code a human could make that couldn't be broken by another human. But no one knows who that person will be or when a code will be broken.

---

Related Sites
Following are links to the external Web sites mentioned in this article. These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability. When you have finished visiting any of these sites, you will be able to return to this page by clicking on your Web browser's "Back" button or icon until this page reappears.

• PGP

• RSA Data Security Secret-Key Challenge

• Entrust

• World Wide Web Virtual Library: Cryptography

Home | Sections | Contents | Search | Forums | Help Copyright 1998 The New York Times Company