Lack of confidence in the security mechanisms associated with the internet is often cited as one of the main brakes on e-commerce. But use of regulated encryption technologies is one way of providing such security.
Legislators in the UK and worldwide are treading a
difficult path. On the one hand, they wish to facilitate an
environment in which secure communications can be
made over the internet in ways that foster confidence
and trust.
On the other, they do not want to provide a tool that could be used by organised criminals or terrorists. Lawyers who wish to exploit dealroom or secure e-mail technology are also watching developments in this area.
Encryption
In essence, encryption transfers the problem of keeping the encrypted data secret to that of keeping a key secret. Where a sender encrypts a message, the recipient will need to be able to decrypt it. In symmetric systems, both parties use the same key to encrypt and decrypt the message. This can lead to security worries over the integrity of the key. It can also be difficult where the parties are complete strangers, which is often the case in internet transactions.
Asymmetric systems rely on two sets of key pairs. Each key pair includes one public key, which can be disclosed to the world at large, and one private key that needs to be kept secret. The most common form of asymmetric system used for e-commerce is public key infrastructure-based systems (PKI). In PKI-based systems, the key used to encrypt is derived from the sender’s private key and the recipient’s public key and the key used to decrypt is derived from the sender’s public key and the recipient’s private key.
Most PKIs currently in use combine the use of symmetric and asymmetric keys. A symmetric key is used to encrypt the message. This key is then encrypted using asymmetric keys as described above.
In theory, all key-based encryption can be broken on the basis of systematic trial and error, that is, by trying all possible keys. The “bit” length of the key used in an algorithm determines how long such trials will take and whether it is possible to crack a key within a practical time period. So the logic behind security is to make a system more difficult and expensive to break than the effort would be worth. Systems security needs to be continually analysed and adapted.
