Your personal, financial and business information crosses the internet constantly. Cryptography is what keeps it from being readable on the way. The mechanics are simpler than the vocabulary makes them sound.
What is cryptography?
Say you have a message you only want one friend to read. You write it in a code the two of you share. Anyone else who finds it sees a jumble of nonsense. Cryptography does that to digital information: it scrambles it so only the intended recipient can unscramble it.
Two types of secret code: symmetric and asymmetric
Both do the same basic job of protecting information. They differ in how many keys are involved.
Symmetric encryption: one secret key
Symmetric encryption is a locked notebook that you and your friend both hold a key to. The same single key locks (encrypts) and unlocks (decrypts) it.
Stream ciphers (a type of symmetric encryption)
A stream cipher encrypts one bit or byte at a time, like a combination lock that changes its combination with every entry you write. That suits anything continuous, live video streaming for instance, where the information keeps flowing.
Block ciphers (another type of symmetric encryption)
A block cipher works in fixed-size chunks. Imagine writing your notebook entries in blocks of, say, 16 words at a time, and scrambling each block with the key.
When you save a document and your computer offers to encrypt it, it is usually running a block cipher called AES (Advanced Encryption Standard) to scramble the contents so only someone with the correct key can read them.
Asymmetric encryption: two different keys
Asymmetric encryption uses two different keys, one public and one private. Think of a notebook with two locks. Anyone can use the public lock to seal something inside, but only your own private key opens it again.
Where you have already used it
Every time you load a site over https, the site hands your browser a public key to lock your information with. Only the site holds the private key that unlocks it.
Using both together
In practice the two get combined, because each is good at something the other is not. Shopping online is the everyday example:
- You start a secure session.
- The website uses asymmetric encryption to send you a symmetric session key, a temporary secret used only for this session.
- Your browser and the website switch to that session key to encrypt and decrypt everything either side sends.
The asymmetric part solves the problem of getting the key to you without someone intercepting it. The symmetric key then does the heavy lifting, because it is the simpler operation of the two.
Digital signatures: proving the message is yours
A digital signature is closer to sealing wax on a letter than to encryption. It proves a message or document really came from you and was not tampered with along the way.
- You sign a message with your private key.
- You send the message out into the world.
- Anyone can use your public key to check that you signed it and that nothing has changed since.
That is what is running underneath when an email or a downloaded file can be confirmed as exactly what the sender intended.