How It Works: Encryption

The Eagle Flies at Midnight

Encryption technology has been big with the military ever since 479 B.C.: According to the historian Herodotus, secret communiques, scratched into wooden tablets that were then covered with wax, tipped off Spartan leaders to an imminent Persian invasion. Corporate IS types have taken advantage of it for years, as well. But home users are increasingly using encryption tools, whether they know it or not.

For example, Microsoft's Internet Explorer and Netscape's Communicator have built-in encryption tools for e-commerce transactions. Without any input from the user, Secure Sockets Layer (known as SSL), a symmetric protocol, scrambles credit card numbers as they travel from the user's desktop to the Web site's server. By default, browsers come with 40-bit encryption, although you have the option of downloading versions that support 128-bit encryption.

You can also take a more active role in protecting your data. Popular e-mail applications, including Microsoft Outlook Express and Lotus Notes, now let users encrypt their messages. Many e-mail applications provide an asymmetric protocol called Secure Multipurpose Internet Mail Extensions, though few people take advantage of it. S/MIME requires a certificate (a digital ID that resides in your e-mail application), which you have to buy from companies such as VeriSign for $15 per year.

For additional protection, stand-alone utilities can encrypt more than just e-mail messages, including binary images and documents and folders on hard drives. PGP for Personal Privacy is the most popular of these programs; you can download a free version of PGP for personal use.

Analysts expect use of strong encryption tools to increase thanks to a recent change in the U.S. Commerce Department's cryptography export regulations. Prior to January 13, most encryption programs were categorized as munitions and subject to the same export restrictions as hand grenades and rockets. You could not export encryption software with keys stronger than 40 bits, under penalty of heavy fines or imprisonment. Under the new rules, the Commerce Department allows some kinds of strong encryption technologies to be exported outside the U.S. Analysts say this won't have much effect initially because most encryption applications were produced outside the U.S. and import of such software was already legal. American software companies stand to gain the most from the new rules, as they will no longer have to develop encryption programs in other countries.

Additional Resources:

• Snake Oil Warnings: Encryption Software to Avoid
  
  
• Microsoft's Security Advisor Program