So we have our file here for Bob.
It's been encrypted with a yes and a strong password bought.
How do we get that password to Bob so that you can decrypt it.
It's not much good sending the password with the email so we could send it via another method we could
send it via an outer band method by maybe calling him or sending my text message.
But that's just not scalable at all.
It's just not usable as a real time encryption method.
Which brings us to the other type of encryption algorithms.
And these are called asymmetric encryption algorithms and this is because they use two keys as opposed
to one key and asymmetric is also referred to as public and private key and public and private are the
two keys that are used in asymmetric encryption.
So we have symmetric encryption.
One key asymmetrical action to keep the public and private.
Some very smart people invented this public private key encryption and the algorithms based on the difficulty
of certain mathematical problems don't go into the details of the mathematics as understanding it isn't
required to keep you secure you just need a basic understanding to make the right choices about the
algorithms and the strength of the algorithms and the cryptosystems that you're going to use.
So the following is examples of asymmetric keys that you will see the first one is RSA and this is very
common.
One of the most common asymmetric algorithms that you will see.
I'll show you where you see them and how they used the security of the algorithm comes from the difficulty
of factoring large numbers into their original prime numbers.
Another common and increasingly popular algorithm is the elliptical curve.
Cryptosystem or ECAC security.
This algorithm comes from computing discrete algorithms of elliptic curves.
There's Diffie Helman and the security.
This comes from the algorithm calculates and discrete algorithms in a finite field.
Defi how much is becoming more popular because it has a property called Forward Secrecy which we'll
discuss later.
And then you've got El-Gamal and the security this algorithm comes from calculating discrete algorithms
in a finite field as well.
These asymmetric algorithms help solve the problem of exchanging or agreeing Keys and also allow for
something called digital signatures so he can potentially use public and private keys to send Bob our
secret key securely without anyone intercepting him.
As I said with public private key algorithms instead of there being just one secret key there are two
keys but in this case there are the public key that is designed to be known by everybody i.e. it's public
and the private key which should be kept secret all times or private.
Now these keys all mathematically related and the two keys are generated at the same time they have
to be generated at the same time because they are mathematically related.
And the Web site that uses Haseeb CPS for example has a public and private key.
They use to exchange a symmetric sesshin key to send your encrypted data.
So it's a bit like the zip file that we've seen.
They use these public private keys and then they need to send another key the key we're using for the
zip file in order to do the encryption.
So in asymmetric encryption if a message is encrypted by one key the other key is required in order
to decrypt that message.
If you encrypt with the private you need the public to decrypt if you encrypt with the public you need
the private Deaker it is not possible to encrypt and decrypt using the same key.
And that's crucial.
You always need the counterpart key to encrypt and decrypt.
But why should you encrypt with a public or private key.
What's the difference what's the point of viewing them.
One of the issues one of them.
Well let me explain the usefulness of these in and how they can be used.
So if you think of yourself as the sender and the sender is encrypting with the receiver Bob's public
key.
This means you are wanting privacy or confidentiality so no one else can read the message but the receiver.
So you encrypt the file with the receiver's public key.
The message can only be decrypted by the person who has a corresponding private key or Bob's private
key.
The receiver though cannot confirm who has sent it that you have sent it.
I no authentication because anyone can use Bob's public key to encrypt.
So in the sense encrypts the receivers public key the message is confidential and it can only be read
by the receiver who has the private key to decrypt the message.
But there's no guarantee of where that message came from.
And that brings us to the second way of using these public and private keys.
So if you encrypt with your own private key then this means authenticating is what you're interested
in.
It means it's important to you that the receiver knows that is you sent it.
So you would encrypt with your private key.
This provides assurance to the receiver Bob that the only person who could have encrypted the data is
the individual who possesses that private key your private key encryption data with the sender's private
key is called an open message format because anyone with a copy of the corresponding public key can
decrypt the message.
So you can think about it like you're putting something officially on the Internet for everyone to read
and because you've encrypted it with your private key everyone can confirm that you have genuinely produced
that confidentiality your privacy is not assured in this case the authentication of the sender or you
is now when various encryption technologies are used in combination such as the ones we've talked about
because these cannot be used in combination and not used in isolation.
They are called a crypto system and crypto systems can provide you with a number of security services
and some of these services are confidentiality which is privacy authentication which is knowing that
Bob is the real Bob or you are the real you know repudiation which means you cannot later deny that
you send to encrypt the message and integrity that the message hasn't been altered in any way.
Examples of crypto systems include anything that uses this encryption technology so PGE pay bit Locher
true crypt tier Alas even bit torrent and even the example of windows that we use to encrypt that simple
little file.
So first to send Bob our file.
We can use Bob's public key to encrypt the file or we can use it to exchange the password for the zip
file.
But we would of course first need Bob's public key and we would only need to receive these public key
ones in a secure manner.
That's important.
And we could them forever send messages encrypted just for Bob to read and PDP is an example of something
that does this as an encryption technology for e-mail.
But you might ask yourself well OK why don't people start to use this for email why isn't PDP use ReMail.
Well it's because exchanging the keys is a little bit of a tricky task and it's also not easy for people
to understand this.
So that's why encryption within email has not been adopted.
And actually e-mail itself is pretty broke and it was never designed for security.
But back to encryption.
So when it comes to public private key cryptography or asymmetric encryption there are some strengths
and weaknesses with public and private key.
You have better distribution than you do with symmetric systems.
So Bob can place his public key on a site or his Web site and anyone can send him encrypted messages
or data to him the only he can read if you use a symmetric key and want to send your file to Bob and
say 10 other people need to give your password to 10 people you know that's just not scalable at all.
So asymmetric algorithms have better scalability than symmetric systems.
Public and private key also provide authentication and repudiation where the weaknesses are.
Well fortunately these encryption algorithms are actually very very slow compared to symmetric systems.
If you look at the big lenth after asymmetric algorithms you'll notice that there are a lot lot higher
than they offer symmetric key encryption algorithms.
And this is an indicator of how much lower they are.
It's back to the analogy of the number of locks on the door with public and private key.
There are many many many more locks on the door.
So it takes much longer to encrypt decrypt So it's mathematically intensive for you.
Which is why we have something called hybrid systems or hybrid crypto systems public and private keys
are used to exchange an agreed keys and we use symmetric algorithms like a yes actually encrypt the
data.
So therefore we get the best of both worlds using Tia and SSL is an example of this type of hybrid system
and so is PDP and we'll talk about a CPS and T.L. s going forward.