Keeping secrets

Phi Kappa Phi Forum, Spring 2003 by Gualtieri, Devlin M

In the summer of 2002, a group of 31,252 computer enthusiasts (aka, computer geeks) completed a quest that had occupied them for almost five years. Their actual labor was small, considering that their computers did most of the work, but theirs was a true labor of love because their reward for this multiyear effort was about thirty-two cents each. They had deciphered a secret message posted with a $10,000 bounty by RSA Security Incorporated. RSA is a Bedford, Massachusetts, corporation that makes millions of dollars each year helping people keep secrets. The business of keeping secrets is called cryptography, from the Greek [kappa][rho][upsilon][pi][tau][omicron] ("hidden") and [gamma][rho][alpha][phi][omega][final sigma] ("writing").

The secret message was encrypted using an RSA proprietary program called RC5 and a 64-bit "key." A key is the "Open Sesame" phrase that allows the program to decrypt the message. The bounty was a way for RSA to prove the effectiveness of its program, and it did. After all, 31,252 people are a lot of resources to throw at a single message, and any cipher with a 64-bit key is less secure than most cryptographic programs now in use. Why do people need such security, and why are they willing to pay so much money for it?

As soon as there was written language, people wanted to keep certain writings secret, and cryptography developed alongside written language. Julius Caesar used a cipher to protect his military communications. Caesar's cipher substituted each letter in a message with the letter three places up the alphabet. The word CAESAR thus would be encrypted to FDHVDU. Substitution ciphers and code-books in which whole words substituted for others dominated cryptography from Caesar's time through the nineteenth century. Later, transposition became another critical cryptographic element. In transposition, the letters of a message are rearranged, so that CAESAR could become EASRAC. Of course, a combination of substitution and transposition gives a stronger cipher, as long as the recipient knows the rules for reversing the encryption. The culmination of these two processes can be found in the German "Enigma" cipher machine that figured prominently in World War II.

The Enigma machine was the creation of the German inventor, Arthur Scherbius, who patented it in 1918. It was improved, used by the German military, and eventually cracked by a dedicated group of English mathematicians that included Alan Turing, a pioneer in computer science who designed special-purpose electro-mechanical computers to crack enemy ciphers. The idea that Enigma was patented may seem strange. After all, we are trying to keep secrets, but in patenting a device the inventor is required to disclose its construction in full detail. The Enigma patent illustrates another cryptographic principle, that the strength of the encryption should be in keeping the key secret, not the algorithm. In fact, you want as many people as possible to analyze your algorithm to find potential flaws, and this is the reasoning behind the RSA bounty.

From the time of Caesar to the end of the Korean War, cryptography was the sole purview of governments and their military. Aside from the occasional love letter, there was no pressing business or personal need for cryptography. The advent of ubiquitous computing and electronic communications changed all that. In 1973, the U. S. National Bureau of Standards (NBS, now the National Institute of Standards and Technology, or NIST) decided that it was time for a cryptography standard and issued a call for proposals. In November 1976, a modified IBM algorithm known as "Lucifer" became the "Data Encryption Standard," or DES.

DES was controversial from the start. The key size for DES was set at 56 bits, whereas the original Lucifer was designed with a 128-bit key. There had been obvious government pressure to standardize the smaller key, a key that could withstand public attempts at cracking messages, but allow for easy government cracking. Note that the RC5 message cracked by our band of computer geeks, who may today have less computing power than did the government in 1976, had a far stronger key of 64 bits. Today, DES is still used, but data goes through DES encryption three times with three different keys, so-called "triple DES," a process that approximates a much larger key size than 56 bits.

The government's crusade to limit the DES key to 56-bits calls attention to the tug-of-war that exists in cryptography between government and public interests. The National security Agency (NSA) is the U.S. government agency that was chartered under President Truman to bring all government cryptography together under one roof. The NSA believed that strong cryptography was its personal sandbox because only spies or criminals would need to keep secrets from the government. World War II had proved that cryptography was an essential part of defense, so the NSA attempted to classify cryptography as "munitions of war" and regulate the publication of research papers on cryptography under the International Traffic in Arms Regulation (ITAR).