By Andre Griffith
In our last article we introduced the basics of cryptology and the concepts of symmetric and asymmetric methods for encryption and decryption. In order to develop these ideas fully, we summarise some of the properties of the asymmetric key model that makes it useful for recording agreements by way of electronic documents. That is we consider the ways in which asymmetric keys allow us to assure the authenticity, confidentiality, non-repudiation and integrity of electronic documents and communications.
The first of these properties is that the keys come in pairs. The second useful property is that once a message is encoded with one key it can only be decoded with the other (corresponding) key. – Taken together, these properties imply that if a message can be decoded using one key from the pair, then it must have been encoded with the other key. These properties are useful for establishing authenticity and ensuring non-repudiation.
A third property is that each key can be used to encode or decode however as stated above, once a message is encoded with one key it can only be decoded with the other, corresponding key. We shall see that this property is useful for achieving confidentiality.
A fourth useful property is that one key cannot be used to guess or compute the other – more correctly stated, it is computationally infeasible to derive one key from the other within a given length of time. This property is useful for maintaining the integrity of electronic documents and communications and is also essential to maintaining confidentiality.
In our example last week where John was able to decrypt a message using one key from an asymmetric pair, he can then be absolutely sure that it must have been encrypted using the other key of the pair. Given that this key was supposed to be held by Jane and by her only, John can be sure of the authenticity of the message he received.
This scenario forms the basis for so-called public key methods where a person or entity wishing to conduct e-commerce obtains an asymmetric key pair. One key, called the public key, is (as its name implied) publicly available to anyone who needs to enter into transactions with that person or entity. The other key called the private key is kept secret to the entity. Given the properties of asymmetric key encryption that we outlined earlier, any message that can be decrypted with your public key must have been encrypted with your private key. Your private key can therefore be used to “digitally sign” documents and under a suitable legal and administrative framework for e-commerce, you would be held liable for any document signed with your private key.
Armed with our asymmetric keys, we can now take a look at how our elemental transaction characteristics of authenticity, non-repudiation, confidentiality and integrity are achieved. Our scenario is that our old friends Jane and John are about to enter into a business transaction. The financial crisis hit John very hard in the UK and he was forced to close his small business Widget Corp which made specialised components for telecommunications systems manufacturers. In contrast to John, back in the Republic of Cayanna Jane’s business Cybercrime Reduction Investigation and Management Enterprise (C.RI.M.E.) Inc. is flourishing. The Senate of the Republic of Cayanna has just passed legislation authorising “wiretapping” and Jane has consequently received a lucrative contract from the authorities in Cayanna to conduct some sensitive investigations into the operations of a criminal gang that exchanges messages by posting them on a foreign website using BlueBerry phones and Internet service offered by the cellular service company. In order to conduct her investigations, Jane requires a Cellular Intercept machine that is capable of capturing arbitrary cellular traffic off the air. Jane also requires specialised software that is capable of deconstructing the signals captured from the cell system by the Intercept machine and displaying them in intelligible form. In this way, she will determine the identity of the miscreants, together with the contents of the messages both of which she will furnish to the authorities. She contacts her old friend John, who very conveniently now works for a company that has just the item needed, however, given that the equipment that Jane seeks is deemed to be sensitive, John’s new company Cell2AllComers Ltd. needs Jane to provide some proof that her purchase is authorised by the Government of Cayanna. There are therefore, three parties to this transaction namely Cell2AllComers Ltd., C.R.I.M.E Inc. and the Government of the Republic of Cayanna represented by Joe, the Minister for Transport and Telecom-munications. We are going to assume that Jane obtains the authorisation from the authorities in her country and sends it along with her purchase order for the intercept equipment.
Now let us recap the requirements for this transaction. John very obviously needs assurance of the authenticity of the message. That is, he needs to be very sure that he is dealing with Jane since he is not free to sell his company’s products to just anyone. John also needs to be assured that the authorisation Jane sends him is authentic i.e. that it really came from the authorities in Cayanna and furthermore he needs assurance that the particular signatory to the authorisation is the competent authority i.e. that the particular official is legally authorised to grant the permission sought by Jane. Jane is going to pay for this electronic equipment 30 days after delivery, and because of this, John’s company does not want to run the risk that Jane collects the equipment and subsequently denies sending the order. That is she repudiates, perhaps claiming instead that she sent an order for 54 the price in support of which claim she produces an altered version of the electronic order (thus violating its integrity). Equally, because of the legal risk to the company for which he works, having satisfied himself of the authenticity of the Government official in Cayanna and of the competence of that official to grant the authorization, John does not wish that official under any circumstances to be able to repudiate issuing the authorisation. Finally, even though the business at hand is legitimate, it is covert and sensitive thus confidentiality is absolutely essential lest the rascals get wind of the operation and start to take steps to secure their communications. Next week we shall see how Jane, John and the Minister Joe, are going to we satisfy these conditions on behalf of C.R.I.M.E. Inc., Cell2AllComers Ltd. and the Republic of Cayanna.
