PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Encryption Basics
353
Private Key Encryption
Private key encryption, also called secret key encryption, relies on authorized people
knowing or having access to a key.This key must be kept secret. If the key falls into the
wrong hands, unauthorized people can also read your encrypted messages. As shown in
Figure 15.4, both the sender (who encrypts the message) and the recipient (who
decrypts the message) have the same key.
The most widely used secret key algorithm is the Data Encryption Standard (DES).
This scheme was developed by IBM in the 1970s and adopted as the American standard
for commercial and unclassified government communications. Computing speeds are
orders of magnitudes faster now than in 1970, and DES has been obsolete since at
least 1998.
Other well-known secret key systems include RC2, RC4, RC5, triple DES, and
IDEA.Triple DES is fairly secure. It uses the same algorithm as DES, applied three times
with up to three different keys. A plain text message is encrypted with key one, decrypted
with key two, and then encrypted with key three.
Note
Somewhat paradoxically, triple DES is twice as secure as DES. If you needed something three times as
strong, you would write a program or implement a quintuple DES algorithm.
One obvious flaw of secret key encryption is that, to send somebody a secure message,
you need a secure way to get the secret key to him. If you have a secure way to
deliver a key, why not just deliver the message that way?
Fortunately, there was a breakthrough in 1976, when Diffie and Hellman published
the first public key scheme.
Public Key Encryption
Public key encryption relies on two different keys: a public key and a private key. As
shown in Figure 15.5, the public key is used to encrypt messages and the private key to
decrypt them.
The advantage to this system is that the public key, as its name suggests, can be distributed
publicly. Anybody to whom you give your public key can send you a secure
message. As long as only you have your private key, then only you can decrypt the message.
The most common public key algorithm is RSA, developed by Rivest, Shamir, and
Adelman at MIT and published in 1978. RSA was a proprietary system, but the patent
expired in September 2000.