An Internet Security Primer

Consumers need assurance of security and privacy

by / February 28, 1999
Internet shoppers this past holiday season spent an estimated $2.35 billion online, according to The Commerce Threshold, published by Forrester Research. Forrester predicts that global Internet sales will reach $3.2 trillion in 2003 if businesses and government cooperate to develop electronic commerce.

With all this money changing hands, concern turns to transaction security. Unless consumers are assured of security and privacy, Internet transactions will not become mainstream.

For many vendors and Web-site operators, the primary concern is the confidence that their site will not be vandalized by crackers or used as a gateway to break into their local area networks.

According to the Clinton administration's 1997 report, "A Framework for Global Electronic Commerce," there are five basic principles of information security: privacy, integrity, authenticity, confidentiality and nonrepudiation.

Privacy involves keeping transaction information between agency and consumer. Integrity is a guarantee that the message is not altered, erased or intercepted by a third party. Authentication lets both sender and receiver know they're dealing with whom they think they're dealing with. Nonrepudiation ensures that parties involved can't deny that they actually sent the transmission.


Cryptography enables confidential information to be transmitted across unsecured networks without the risk of interception or tampering, essentially by putting the data into code. The receiver has a secret key used to decrypt the message. Only those having the correct key can decode the document.

It may be foolproof, but not expert-proof. Unauthorized users may decrypt a message by figuring out the key themselves. One way is to find a pattern that can be used to reconstruct the original message or the key used to encrypt it. Another is a full-frontal assault in which crackers try to break the code by guessing millions of possible keys until the right one is found. A fast computer is capable of trying millions of guesses in seconds, but the process is still no walk in the park.

In symmetrical encryption, the same secret key is used to both encrypt and decrypt a message. Symmetric algorithms present problems for users who have never met or exchanged keys.

Public Key Cryptography

Public key cryptography is also known as asymmetric cryptography. Keys come in pairs. One key is public, widely available. The other, private key is a closely guarded secret.

To send a secure message, one looks up the recipient's public key and uses it to encrypt the message. The message then can be sent over an unsecured channel without fear of interception. The private key is necessary to decode it. The advantage of public key encryption is that no arrangements need to be made in advance.

Digital Signatures

Another benefit of public key cryptography is that it allows users to create digital signatures. Digital signatures are a reversal of the public key encryption/decryption scheme. A digest of the text is encrypted and sent with the text message.

A "message digest function," or "one-way hash," takes a plain text message and transforms it into something that looks random. Message digest functions generate short, fixed-length values known as "hashes." The hash is much shorter than the original message. There is no known way to create two different messages that generate the same hash. The recipient decrypts the signature and recomputes the digest from the received text. If the two digests match, the message is authenticated, verifying that the text has not been altered in transit. Messages encrypted using an individual's
private key can only be deciphered with the public key.

Both symmetric and public key cryptography provide integrity-checking. If a message is modified in transit, either because of a communication error or deliberate intervention, the message won't decrypt correctly.

Digital Envelopes

While public key encryption systems seem ideal for the Internet, they appear to be slower than symmetric systems, making them unsuitable for transferring large documents. The solution is to combine the two systems. First, a secret key is generated at random. This secret key, or session key, is discarded after the communication session. Second, using symmetric algorithms and the session key, the message is encrypted. Third, the session key is encrypted with the recipient's public key. This becomes the "digital envelope."

The digital envelope is a code within a code. The public key method is used to exchange the secret key, and the secret key is used to encrypt and decrypt the message. The encrypted message and digital envelope are sent to the recipient. The recipient's private key decrypts the message, recovering the session key. The session key decrypts the message. The message is secure because it is encrypted using a symmetric session key that only the recipient and sender know.

Certifying Authorities

In public key encryption, a large networked database keeps track of everyone's public keys and distributes them on demand. Certifying authorities are third-party commercial enterprises that vouch for the identities of individuals and organizations. They provide users with a digital certificate that has been signed by one of these authorities. From the certificate, the sender can verify the recipient's identity and recover his or her public key.

There are a variety of cryptographic protocols on the Internet, each specialized for a different task.

The Protocol of Protocols

Some protocols are designed to secure specific applications such as e-mail and remote login. Others are for more general applications, providing cryptographic services to multiple communications modes.

SSL (Secure Sockets Layer) is the dominant Web protocol for encrypting general communication between server and browser. SSL was introduced by Netscape, which has released four versions. Microsoft released its PCT protocol in 1996, with its first release of Internet Explorer. Microsoft supports SSL in all version of its Internet software, in addition to PCT. SSL 3.0 is implemented in all newer Explorer versions.

Secure Electronic Transaction (SET) is a specialized protocol for safeguarding credit card transactions. It was jointly developed by Visa, Mastercard, Netscape and Microsoft. Unlike SSL, a general-purpose system of encrypting communications, SET is highly specific, used only to secure credit and debit card transactions between customers and merchants.

Although a large number of software vendors announced support for the protocol, only Verifone Corp. released a SET product. It is predicted that Web browsers will eventually provide direct support for SET, either by incorporating the protocol in the browser software itself or by having users download it in the form of an ActiveX control, Java applet or plug-in. It is likely to assume a major role in Web financial transactions this year.

Using SSL to accept credit card payments is the way it's most often done on the Net and the basis for the "commerce systems" sold by Netscape, Microsoft and others. The problem is that while SSL transmits the credit card numbers safely from customer to merchant, it does not help with the rest of the transaction: checking the number for validity, checking that the customer is authorized to use this card, authorizing the transaction with the customer's bank and actually processing the transaction. High-end commerce systems validate orders as they come in, contacting a credit card authorization service's server via SSL or a proprietary protocol.

Such systems may also manage refunds, back orders, transaction logging, shopping cards, online catalogs and inventory control. A fully functional credit card processing system is either a lot of custom programming or an expensive packaged solution. Another problem with SSL-based schemes is server security. Because credit card numbers are transmitted to the merchant's Web server, there's a fair chance that the merchant will choose to save it to a file or database. If someone succeeds in breaking into the merchant's server, the entire database of credit card numbers may be compromised.

Virtual Private Networks

Virtual private networks (VPNs) or extranets play an important role in securing the Internet, and are becoming attractive to many businesses and government agencies. A VPN allows safe business-to-business transactions using a "secure tunnel" through the public network. VPNs employ tunneling, encryption, authentication and access control.

There are two categories of tunneling. One is end-to-end tunneling, in which a tunnel is established from a user's PC to another PC or server. PCs at both ends establish the tunnels and encrypt and decrypt data between the two computers.

The other category is node-to-node tunneling, used to connect LANs at different sites. The data is encrypted and tunneled to the remote users.

Three common tunneling protocols are Point-to-Point Tunneling Protocol (PPTP) -- most widely used -- IP Security (IP Sec), and the Layer 2 Tunneling Protocol (L2TP).

See No Evil, Intercept No Evil?

Stronger encryption is clearly necessary for any serious security. However, the debate rages between security and privacy advocates. Some government and law enforcement agencies oppose the use of stronger and unbreakable encryption keys, citing national security and law enforcement reasons. They don't want terrorists, drug dealers and other criminals to have absolutely unbreakable encryption.

On the other hand, privacy advocates are concerned about the security of individuals' private information from both government and online criminals.

Both advocates have strong arguments, and it may be some time before technology and legislation strike a balance.