E

Encryption is the process by which easily comprehended information, such as ordinary text, a photograph, or a motion picture, is converted into a form that can only be understood with the aid of a key. The process by which this key is used to convert the encrypted message back into its easily understood form is called decryption. The encrypted message is called a ciphertext; the unencrypted message is called plaintext. The method by which the plaintext message is encrypted is called a cipher; it is often incorrectly referred to as a code. While a “code” also converts information into some other form, this is done for technical reasons rather than to keep the information secret. For example, a code such as the American Standard Code for Information Interchange (ASCII) or Unicode, both used to convert the letters and characters of ordinary text to binary numbers for use in computers, is necessary in order to allow human beings to use binary computers; the usefulness of these codes would be destroyed if the information was kept secret, however. Encryption, in which the existence of the message is not hidden but the content of the message is rendered incomprehensible, is also sometimes confused with steganography, in which the existence of the message is hidden; encryption and steganography may be combined, of course.

Most encryption methods can be classified as either symmetric or asymmetric key algorithms. The former and much older type requires that the sender and receiver share a key, kept secret from the rest of the world; the key is used both to encrypt and decrypt messages. The key can be very simple or very complex, but the system has two weaknesses: only persons who know the key can send and receive encrypted messages, and anyone who has the key can decrypt all messages encoded with it. As the number of persons with whom the key is shared increases, the likelihood that one of them will inadvertently or deliberately allow the key to fall into the hands of an unauthorized person increases as well.

Simple and not-so-simple symmetric-key encryption has been in use for millennia. One of the simplest forms, the substitution cipher (in which each letter of the alphabet is represented by some other letter) was used by the ancient Romans. As both ciphers and the ability of cryptographers to break them grew more complex, mechanical devices were invented to encode and decode them. These devices, especially those developed by British and American mathematicians to break German and Japanese ciphers during World War II, were among the early ancestors of modern computers.

The tremendous advances in cryptography for military and intelligence purposes during World War II led to government involvement in and regulation of cryptography. In 1952, during the Korean War, then-President Harry Truman created the National Security Agency (NSA). At the time the primary function of the NSA was cryptography and its counterpart, cryptanalysis, or the breaking of codes used by others. The NSA worked to maintain a United States lead in these areas, which it did successfully until the emergence of asymmetric or public-key cryptography.

Public-key cryptography (PKC) avoids the weakness of symmetric cryptography by using two keys: a public key, available to all, used to encrypt the message, and a private key, known only to the recipient, used to decrypt it. Once the public key is made available, anyone who wishes can use it to send encrypted messages to the recipient. The public key may be made available to anyone without increasing the likelihood that the private key will fall into the wrong hands, so anyone can encrypt messages while only the authorized recipient can decrypt them (Lessig 1999, 36–38).

The “invention” of PKC is generally credited to the team of Martin Hellman, a professor at Stanford University, and two graduate students, Whitfield Diffie and Ralph Merkle, and to the slightly later work of three Massachusetts Institute of Technology professors: Ron Rivest, Adi Shamir, and Len Adleman (Diffie & Landau 2007). The latter group patented their encryption method, known as RSA (the initial letters of the surnames of the inventors) and it forms the basis for asymmetric encryption methods in wide use today. The NSA and its British counterpart later claimed to have been aware of the possibility of PKC for some time and to have kept it secret for security reasons.

The NSA initially attempted to prevent the public’s use of PKC. Under the Arms Export Control Act (AECA) and the International Traffic in Arms Regulation (ITAR), cryptographic devices were classified as “significant military equipment.” Exporting public-key encryption outside the United States was, at least in theory, a violation of AECA and ITAR. But privacy pioneers like Phil Zimmerman, the developer of the popular PKC program Pretty Good Privacy (PGP), made public-key encryption methods available over the Internet (including, inevitably, to people outside the United States) and emailed their public keys to persons outside the United States (Rubinstein 1995, 425–427). Providing information on the Internet, however, even for free, may constitute an export; after making PGP available as a free download, Zimmerman was investigated for violation of AECA but never prosecuted.

Opposition from nearly all sectors of society led to the demise of the Clipper chip (Pednekar-Magal & Shields 2003). The United States was not the only country to attempt such centralized control of encryption; in France, for instance, a Clipper-like program was instituted in the mid-1990s, but abandoned in 1999. Asymmetric encryption is now an accepted part of Internet commerce, transparent to most users. PKC is incorporated into Web browsers in the form of the Secure Socket Layer (SSL), which encrypts messages between the browser and a Web server. Most users will not be aware that SSL is in use unless the Web page tells them or unless they notice the tiny “lock” icon on their Web browser, or by looking at the URL: encrypted pages generally have an address starting with “https” rather than “http.” SSL can also be used to confirm a server’s or user’s identity through the use of a digital certificate, and can be used to ensure that the content of a message has not been altered in transit (Lessig 1999, 39–40).

Public-key encryption is widely available and difficult to break; it has also become an indispensable part of the Internet economy. In addition, PKC has numerous other legitimate uses: it can be used to verify identity through digital certificates and signature, it can be used to preserve the confidentiality of business and personal communications, and it can be used to protect copyrighted information (such as a movie recorded on a DVD) from unauthorized copying. But PKC can also be used by terrorists, child pornographers, and other criminals. The challenge for lawmakers is to create a set of rules that permits the economically and socially beneficial uses of PKC—encryption of credit card numbers, bank account information, business records, confidential business and personal communications, and the like—while controlling the harmful uses.

The first problem is not easily solved; the same encryption tool that can be used to conceal a legal but confidential business plan can be used to conceal an illegal and dangerous terrorist plot. Encryption can create a virtual private network that can save businesses millions of dollars in infrastructure costs—or provide a hidden marketplace for child pornographers. In this situation the encryption technology is merely a tool, and the appropriate legislative approach is to enhance penalties for crimes committed using that tool. A knife that can be used for slicing melons can also be used to commit a robbery; the legislature has responded not by outlawing knives but by providing that the penalty for a crime committed with a knife is more severe than the penalty for a similar crime committed without one.

There seems to be no downside to allowing the use of encryption to verify the identity of Web servers and Internet users. Copy protection encryption, however, has presented significant legislative difficulties in commercial transactions, aside from privacy concerns. The content industry has lobbied heavily for legislative protection for, and even mandate of, copyright protection encryption technologies. Yet users and equipment makers resent copy protection encryption; equipment must be designed to play encrypted material, sometimes with uneven results. And users may want to record protected material to other media for legitimate space-shifting purposes. The use of encryption thus diminishes utility while simultaneously raising the cost: consumers end up with a more expensive but less useful media player.

Within the United States the problem is addressed by a combined legislative and technological approach. Movies could easily be recorded with nearly unbreakable encryption. But in order to make movies that can be played, the recording industry must share the decryption key with the equipment manufacturing industry; the more complex the encryption, the greater the chance of incompatibility, and the greater the number of keys distributed, the greater the chance that a decryption key will be leaked to the general public.

Instead, movies are recorded with relatively simple encryption, and the Digital Millennium Copyright Act (DMCA) provides penalties for the circumvention of this encryption. The combination of encryption to stop the casual user from copying the movie and criminal penalties to deter the more sophisticated user have managed to control, though not eliminate, piracy of movies within the United States.

An intriguing event, and a measure of the level of public fascination with encryption and cipher breaking, has been the emergence of a subgenre of popular fiction on the topic. These novels tend to be multilayered; on the surface they may be read as straightforward adventure novels. On the next level they provide a series of puzzles, related to the story, which the reader can decipher as the plot moves forward. On subsequently deeper levels they provide clues that the reader can use to decipher a variety of messages that may give additional information about the story, or about the author’s future work, or about other things unrelated to the story. These novels range from formulaic stories with simple ciphers aimed at a mass market (Dan Brown’s The Da Vinci Code) and cipher novels for children (the Artemis Fowl series) to the more complex (and thus more rewarding) work of Umberto Eco and to complex ciphers requiring a degree of mathematical sophistication (Neal Stephenson’s Cryptonomicon).

Statutes

• Arms Export Control Act, 22 U.S.C. § 2778

• Digital Millennium Copyright Act, 17 U.S.C. § 1201

• Security and Freedom through Encryption (SAFE) Act, H.R. 850, 106th Cong. (1st Sess. 1999)

Regulation

• International Traffic in Arms Regulation (ITAR), 22 C.F.R. §§ 120–30

Case

• U.S. v. Hsu, 364 F.3d 192 (4th Cir. 2004)

See also Copyright; Copyright Infringement; Cyberpunk; Digital Rights Management; File-Sharing; Hacking; Phreaking; Privacy; Steganography

Sources and Further Reading

Nonfiction

Andre Bacard, The Computer Privacy Handbook: A Practical Guide to E-Mail Encryption, Data Protection, and PGP Privacy Software (Berkeley, CA: Peachpit Press, 1995)

Whitfield Diffie & Susan Landau, Privacy on the Line: The Politics of Wiretapping and Encryption (Cambridge, MA: MIT Press, updated ed. 2007)

Niels Ferguson, Bruce Schneier, & Tadayoshi Kohno, Cryptography Engineering (Indianapolis: John Wiley & Sons, 2010)

Warwick Ford & Michael S. Baum, Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption (Upper Saddle River, NJ: Prentice Hall, 2d ed. 2001)

A. Michael Froomkin, “The Metaphor Is the Key: Cryptography, the Clipper Chip, and the Constitution,” 143 University of Pennsylvania Law Review 709 (1995)