One of the most important things you can understand in terms of open source security is how encryption operates on networks. Feel free to skip this section if you already understand these terms. If you don’t, then read on.

Why is encryption important? At one time, Microsoft’s old LAN manager product (a precursor to Windows NT and 2000) did not encrypt its passwords as it communicated with other hosts. As a result, this particular operating system fell out of favor, forcing Microsoft to improve its product. One of those improvements was the use of encrypted transmissions. Encryption is not a foolproof solution. It is possible to misconfigure your encryption tools, and even properly encrypted transmissions are not completely safe. Nevertheless, encryption does tend to raise the bar enough to make most hackers search for other systems to attack. Before we continue, it is important to understand the three types of encryptionin general use:

Symmetric The use of one key to encrypt and decrypt information. This is a common type of encryption, but can be easily defeated if you misplace the key, or if a malicious user intercepts the key in transit. If a malicious user is able to intercept the key, he or she can then use it to decrypt your secret messages.

Asymmetric This type of encryption uses a mathematically related key pair to encrypt and decrypt information. It is commonly used on the Internet and on LANs, because it reduces the likelihood that the key can be learned by a malicious user, and aids in authentication.

One way The use of an algorithm to encrypt information so that it is, mathematically speaking, impossible to unencrypt it. One-way encryption is also used to read a file and then create a hash of that file. The resulting hash value is said to be mathematically unrecoverable. You should understand that in regard to networking, the “information” discussed in this section can include a file, or a series of network packets emanating from a network host. Many encryption applications, such as GNU Privacy Guard (GPG) and Pretty Good Privacy (PGP) employ all three of these types of encryption, as you will see later.

Symmetric Key Encryption

Your car key is a crude, although helpful, example of symmetric encryption. Consider that most people use the same physical key to lock, unlock, and start their cars. If you lose your key, anyone who finds it can locate your car, insert your key in the door and the ignition, and then drive it away. Suppose, now, if you tried to pass this key to another person in a crowded room, and someone you do not trust was to intercept it. You would probably then have a problem: the only thing keeping this untrusted person out of your car is that person’s honesty and his or her knowledge of what your car looks like. If that person wanted to, he or she could find your car, open it, and drive away.

The use of symmetric encryption across an untrusted network such as the Internet (or, really, your LAN or enterprise network) presents the same problem as the use of a single car key: anyone who intercepts your symmetric key with a packet sniffer can decrypt your messages. This type of attack is a sniffing attack. A sniffing attack is a type of man-in-the-middle attack, where a host that resides in the middle of a connection is able to obtain and then manipulate data.

The obvious response to this analogy and the threat of sniffing attacks would be,“Well, I guess I just won’t send my passwords across the Internet or my network.” However, it has traditionally been very difficult to get your job done without sending passwords across the Internet. The ability to communicate securely is the backbone of e-commerce and network communication. So, how will you get that password to a person? Even if you use a telephone (a very slow, awkward option), you are not guaranteed safety. After all, your friend who receives this password could write it down on a sticky note, exposing it to anyone passing by. Besides, what if you needed to get a password not to a person, but to a network host?

Another problem with the use of symmetric encryption is that if someone sniffs your symmetrically encrypted message, it is possible for this person to use a password-cracking program to guess the password (the key) you used to encrypt the message.This type of application effectively reverse-engineers the password creation process by taking multiple guesses to try and find the answer. Such applications include L0phtCrack (www.atstake.com/research/redirect.html) and John the Ripper (available at various sites, including http://packetstorm.securify.com). Using such applications, a suitably powerful computer, and enough time, a person can guess the right password.This type of attack is called a brute-force attack.

Asymmetric Key Encryption

One of the answers to sniffing and brute-force attacks is the use of a pair of keys. Asymmetric encryption allows you to do two things:

Encrypt transmissions

Authenticate users and hosts

For example, suppose that the car key you had in the earlier example concerning symmetric encryption was only part of the key necessary to unlock and start the car. Suppose further that this physical key, which you can now publicly distribute, was related to another key locked in your car, and that this locked key then had a way to ask any holder of your public key to further authenticate himself before he gained access to use your car.This is basically how asymmetric key encryption works.

The public key can be distributed to anyone. It can be placed on public key servers all over the Internet or to anyone you know (or don’t know, for that matter). However, the private key must be kept, as you might have already guessed, private. The easiest way to understand public key encryption is to understand the relationship between each key pair. Each pair is generated at the same time. The algorithm that creates the key pair ensures that this pair is so related that one half of this pair can decrypt the other half.