NOTE: This site is obsolete. See book draft (in PDF):

The Laws of Cryptography with Java Code.

---

Mankind has used the science of cryptography or ``secret messages'' for thousands of years to transmit and store information needing secrecy. Until recently the military expended most of the effort and money involved. However, starting in 1976 with the introduction in the open literature of public key cryptography by Diffie and Hellman, the non-military and academic pursuit of cryptography has exploded. The computer revolution has given people the means to use far more complicated cryptographic codes, and the same revolution has made such widespread and complex codes necessary. At the start of a new millennium, even non-technical people understand the importance of techniques to secure information transmission and storage.

Cryptography provides four main types of services related to data that is transmitted or stored:

• Confidentiality: keep the data secret.
• Integrity: keep the data unaltered.
• Authentication: be certain where the data came from.
• Non-repudiation: so someone cannot deny sending the data.

Consider first confidentiality. This is just a big word meaning ``secrecy'' -- keeping the data secret. For this, one uses encryption, a process of taking readable and meaningful data, and scrambling or transforming it so that someone who happens to intercept the data can no longer understand it. As part of the process, there has to be a way for authorized parties to unscramble or decrypt the encrypted data.

Integrity means keeping the data in unaltered form, while authentication means to know where the data came from and who sent it. Neither of these services has anything to do with secrecy, though one might also want secrecy. Consider, for example, the transfer of funds involving U.S. Federal Reserve Banks (and other banks). While secrecy might be desirable, it is of small importance compared with being sure who is asking for the transfer (the authetication) and being sure that the transfer is not altered (the integrity). One important tool that helps implement these services is the digital signature. A digital signature has much in common with an ordinary signature, except that it works better: when properly used it is difficult to forge, and it behaves as if the signature were scrawled over the entire document, so that any alteration to the document would alter the signature. In contrast, ordinary signatures are notoriously easy to forge and are affixed to just one small portion of a document.

The final service, non-repudiation, prevents someone from claiming that they had not sent a document that was autheticated as coming from them. For example, the person might claim that their private key had been stolen. This service is important but tricky to implement, and is discussed in various of the books referred to in the references.

Taken all together, cryptography and its uses and implementations have become essential for mankind's technical civilization. The future promise is for the smooth functioning of these and other services to allow individuals, businesses, and governments to interact without fear in the new digital and online world.