Code and ciphers: Julius Caesar, the Enigma and the internet

Public key cryptography 165
graphics terminals communicating with them by telephone lines. Many of
these organisations were also using computers at distant sites as well as
those ‘in house’. In order that diverse users could communicate securely
with each other some common form of encryption was required. Since all
the users would have to know how the encryption would be carried out it
was clear that the encryption algorithm would have to be made public and
that the individual users would have to have their own, secret, keys,
without which it would be impossible to decipher their messages. This, in
turn, implied that the method of encryption must be extremely secure.
In addition to the problems already mentioned with the introduction
of computer networks new aspects of security arose. Here are two examples:
(1) ‘The authentication problem’. A user, X say, receives an e-mail
message which apparently comes from Y. How does X know that the
message really has been sent by Y and, even if it has, that it has not been
altered in some way? The fact that the message has Y’s e-mail address on it
is no guarantee, since someone might be using Y’s computer in his
absence. Even if Y has a password it is possible that, having logged on, he
has gone out of the room for a few minutes leaving his computer idling, a
bad habit which invites misuse. This would enable a third party, Z, to use
Y’s computer in his absence to send the message to X. If X is Y’s bank and
the message is authorising the transfer of a large sum of money from Y’s
account to an overseas account the bank needs to have some way of checking
that the message is genuine, otherwise a fraud can be successfully
committed. Alternatively, is it possible that Y has indeed sent a message to
X and that Z has somehow intercepted it and changed part of it so that it
benefits him?
(2) ‘The signature verification problem’. A user X sends a message to Y
authorising some action or other. Subsequently X denies that he sent the
message to Y. The dispute goes to a third party, a judge perhaps, who has
to decide if X really did send the message or not. Is there a way in which X,
having signed the message, cannot subsequently deny that he sent it and,
conversely, that Y cannot claim to have received a different message?
These are practical problems which have been the subject of much
research and discussion ever since computer networks came into existence
and we shall return to them in the next chapter. Various solutions
have been proposed but the essential feature of most of them is that there
is a method whereby two people who wish to communicate are enabled to
do so by means of a common encryption system which involves the use of