Front cover - IBM Redbooks

24 Lotus Security Handbook
character replacement algorithm; if you want to encrypt a message, you just
replace each letter of the alphabet with another. For example:
Original letter: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Replacement: G H I J K L M N O P Q R S T U V W X Y Z A B C D E F
In this case, the letters in the alphabet have just been shifted seven places to the
right, so HELLO WORLD would translate to NKRRU CUXRJ. The premise on which this
code is based is that both the sender and the receiver know a common key, in
this case the number of places to shift the letters.
This shared secret allows the receiver of the message to reverse the encryption
process and read the scrambled message.
Symmetric encryption gets its name from the fact that the same key is used to
encrypt plaintext and decrypt the corresponding ciphertext. Symmetric
encryption algorithms used by computers have the same elements as the simple
example above, namely a mechanism to scramble the message (also known as
a cipher) and a shared secret (a key) that allows the receiver to unscramble the
encrypted message.
Determining the strength of a symmetric cipher
The strength of a symmetric key cipher of this kind is dictated by a number of
factors. The first is that it effectively randomizes the output, so that two related
clear-text messages do not produce similar encrypted results. The degree of
randomness in cryptography parlance is generally called entropy.
Our childish example fails badly in this area because each letter always converts
to the same encrypted result, and because it does not encrypt spaces. The
kindergarten cryptanalyst can quite easily break the code by knowing that any
one-letter word is likely to be an A.
Another way our example fails badly is that if for some reason the algorithm is
known (in our case, the algorithm is: “Shift each letter seven places to the right”),
then the person who knows that can now easily decrypt each subsequent
message.
This is where the concept of a key is important. With a key-based algorithm, an
effort is made to protect the key. This permits the cryptographic algorithm to be
reviewed and scrutinized. A good algorithm is one that can be understood, is
efficient, and cannot be used for encryption without the proper key. The
algorithms we discuss later on in this chapter all share these common traits.