Expertiza_Wiki - User contributions [en]

CSC 379 SUM2008:Week 5, Group 1

2008-08-09T00:29:58Z

Mwmccask: /* Avoiding the Need for Whistleblowing */

== Avoiding the Need for Whistleblowing ==

Whistleblowing is a term used to denote an activity whereby an individual within a group (a company, a university, etc) presents a public report detailing a (typically) unethical action that has taken place within their group. The report is presented to the public because the individual has presumably already reported the violation via internal channels, and no action has taken place. By making the violation public, pressure is applied to the group to rectify the problem.

== Problems With Conventional Whistleblowing ==

Whistleblowing is not without its disadvantages, however. The primary problem with whistleblowing is that the whistleblower almost always faces retaliation. This can range anywhere from facing hostility at work to being sued by the company for breach of confidentiality. Whistleblowers may even face demotions, reassignments, or in the worst case may lose their jobs. In rare instances, threats to their well-being or families may also occur. There is therefore a strong disincentive to remain silent about an illicit activity, should it be discovered. While laws are in place to protect whistleblowers, knowledge of their existence is limited, and whistleblowers may only find out about them after the statute of limitations has expired.

But preventing or stopping that illicit activity is the morally and ethically correct course of action, and steps to do so can only be taken after the knowledge can be communicated to the people with the power to take action. And if the severity of the problem is great enough that it may result in loss of life, the whistleblower would even have a moral obligation to report his or her findings, regardless of the consequences.

To balance the simultaneous needs of allowing whistleblowers to file their grievances and protecting them from retribution, alternatives are necessary. The below sections attempt to list and explain these alternatives.

== Alternatives ==

== Assignment Description ==

Examine the ways an organization can help employees resolve concerns internally, and thereby avoid the need for external whistleblowing. How do these practices, such as anonymous reporting hotlines, apply to the work environment of a software engineer?

Due to ineffective or nonexistent feedback processes within an organization, many important concerns never reach anyone who is willing or able to take action. Employees may forgo making complaints due to processes that are hard to use, or because the company culture has no way to report anything, except to one’s immediate superior.

What can be done to reduce the need for external whistleblowing? Are there proven cultural fixes? Technological fixes? If someone has a less serious concern, which (s)he considers too insignificant to take the risk of external whistleblowing, how could this be actively addressed before problems arise? Is there an ethical obligation on the part of organizations to adopt practices that encourage effective internal whistleblowing? Please explain your answers.

* http://www3.interscience.wiley.com/journal/119949153/abstract
* http://www.springerlink.com/content/t61246w14l64k416/
* http://portal.acm.org/citation.cfm?doid=367211.367274
* http://courses.ncsu.edu/csc379/lec/001/lectures/wk15/lecture.html
* http://ethics.csc.ncsu.edu/basics/whistle/

Encryption

2008-08-05T01:54:52Z

Mwmccask: /* What is Encryption? */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key.[http://en.wikipedia.org/wiki/Cryptography#Terminology] The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of [http://www.csl.sri.com/users/neumann/judiciary.html key recovery], this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

Encryption

2008-08-05T01:53:28Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of [http://www.csl.sri.com/users/neumann/judiciary.html key recovery], this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

Encryption

2008-08-05T01:52:45Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of [http://www.csl.sri.com/users/neumann/judiciary.html key recovery], this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann
These will be sorted later on.
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

Encryption

2008-08-05T01:52:02Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of [http://www.csl.sri.com/users/neumann/judiciary.html key recovery], this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann
These will be sorted later on.
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

Encryption

2008-08-05T01:51:01Z

Mwmccask: /* Problems */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of [http://www.csl.sri.com/users/neumann/judiciary.html key recovery], this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:49:51Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:49:24Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:49:01Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption '''Return to topic page''']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:48:17Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description 'Return to topic page']

Previous Pages
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]

General Info
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:45:22Z

Mwmccask: /* Examples of Encryption Software */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA]. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:44:58Z

Mwmccask: /* Examples of Encryption Software */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including [http://mathcircle.berkeley.edu/BMC3/rsa/node4.html RSA.] The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:43:39Z

Mwmccask: /* Problems */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US this is a non-issue, as 128-bit encryption or higher is not uncommon.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:27:01Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case[http://www.toad.com/gnu/export/export.html] against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:16:34Z

Mwmccask: /* What is Encryption? */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5x1038 combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:09:25Z

Mwmccask: /* Problems */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5E38 (that's the number 35 followed by 37 zeros) combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*[http://itlaw.wikia.com/wiki/Key_escrow ''Key escrowing''] - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:08:06Z

Mwmccask: /* What is Encryption? */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5E38 (that's the number 35 followed by 37 zeros) combinations, meaning that the likelihood of correctly guessing the key is astronomically small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:07:48Z

Mwmccask: /* What is Encryption? */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in roughly 3.5E38 (that's the number 35 followed by 37 zeros) combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-05T01:05:04Z

Mwmccask: /* Examples of Encryption Software */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon [http://www.webopedia.com/TERM/P/public_key_cryptography.html public-key encryption] technology.
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-03T23:24:13Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[[Image:new.gif|New]][http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[[Image:new.gif|New]][http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[[Image:new.gif|New]][http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[[Image:new.gif|New]][http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[[Image:new.gif|New]][http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[[Image:new.gif|New]][http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[[Image:new.gif|New]][http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[[Image:new.gif|New]][http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[[Image:new.gif|New]][http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[[Image:new.gif|New]][http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[[Image:new.gif|New]][http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-03T23:22:21Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/clipper/ Clipper topic page]
*[http://ethics.csc.ncsu.edu/privacy/encryption/export/ Encryption exporting topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-03T23:11:07Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[[Image:new.gif|New]][http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-03T23:07:14Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-03T23:04:51Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://ethics.csc.ncsu.edu/privacy/encryption/ Old topic page]
*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption topic description]
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

Encryption

2008-08-03T23:02:51Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption Wikipedia entry on encryption]
*[http://computer.howstuffworks.com/encryption.htm How encryption works] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html Piecing together the encryption puzzle] by Paul, Hastings, Janofsky & Walker

*[http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379_SUM2008:Topics#Encryption Topic Description]

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 Ethical considerations of privacy and cyber-medical information] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm Ethical considerations for providing professional services online] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ITLaw.Wikia entry on encryption]

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 Your encryption key a fifth amendment right?]
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 A pretty good way to foil the NSA] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html Voice encryption may draw U.S. scrutiny] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html Federal government pushes full-disk encryption] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization Federal encryption standardization] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html Government buys encryption] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 Constitutional conflicts with encryption regulation] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html The university's role in advancing data encryption, part 2] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html Unlocking encryption management] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html Security risks in key recovery] by Peter Neumann

CSC 379 SUM2008:Week 4, Group 2

2008-08-01T20:57:58Z

Mwmccask: /* Benefits */

==Open Government==
Most bills are passed by legislatures without ever being read by most legislators. Letters, articles, reports, all often never escape the physical mediums (paper) of their existence. Although technology has developed to the point where all non-private information in the United States government can, in theory, be made openly available, the support structures and culture of information sharing has not caught up to make full use of them. Efforts are being made to use digitization and sharing technology; one of the most notable digitization efforts is THOMAS, a joint effort by the Library of Congress and the Government Printing Office (GPO).

Examine the ethical implications of making policy with inadequate access to information, and the efforts being made to address those concerns. Is there a need for a change in existing support structures and culture of information sharing in government? Should support structures and culture change to encourage greater information sharing, if it required the government to slow down decision-making processes?
==History==
Open government is the doctrine that all levels of political administration should be open to public viewing and scrutiny. The origins of which date back to the Enlightenment in Europe in the eighteenth century. More recently, the passing of the [http://www.usdoj.gov/oip/ Freedom of Information Act (FOIA)] in the United States in 1966 is seen as the beginning of a modern movement toward open government. After its passing, several countries have followed suit in the subsequent decades.

The FOIA allows for complete or partial disclosure of previously unreleased information and documents from the US Government based on a series of conditions. It applies to all government agencies. There are nine exemptions to the FOIA:
*Classified national defense and foreign relations information
*Internal agency rules and practices
*Information that is prohibited from disclosure by another federal law
*Trade secrets and other confidential business information
*Inter-agency or intra-agency communications protected by legal privileges
*Information involving matters of personal privacy
*Records compiled for law enforcement purposes
*Information relating to the supervision of financial institutions
*Geological information on wells

[http://thomas.loc.gov/ THOMAS] is a database kept by the Library of Congress detailing legislative information since 1995. The database is named after Thomas Jefferson. It includes information including:
*Bills and resolutions
*Congressional activity
*Congressional record
*Committee information
*Treaties
*Historical documents

A new political philosophy is [http://en.wikipedia.org/wiki/Open_source_governance open source governance], which details a post-national state where any interested citizen can add to the creation of a policy, by way of a wiki or another mechanism. The core of such a government structure is a "central codebase" that are maintained by public registry. The policies are distributed to local areas that can alter the policy for their own uses and can send improvements back to the core.

== Benefits ==

One of the advantages of an open source government is that more of the government's actions and intentions become transparent by posting reports about said activity in a widely accessible place (such as the internet). This gives a much wider range of people the opportunity to decide for themselves if they actually support what their leaders and representatives are doing.

For example, one common problem with bills is that they typically get "riders," which are extra provisions that are appended to the bill and may or may not have anything to do with the original intent of the bill. Typically they are used to covertly pass items through the bill-approval process that would otherwise be met with opposition. At this time, the threat of being discovered is minimal because the riders tend to be written in a very verbose, jargon-fill manner, which very few people are willing to examine and interpret.

It is not really a question of how to obtain access to information about these bills and various attachments. All of this information is available to the general public (e.g. via [http://thomas.loc.gov/home/abt_thom.html THOMAS]); anyone is well within their bounds to perform their own research. It is more a question of how to obtain access to this information that is easily digestible and understandable. As stated, the wording of bills can be very confusing. Not everyone has the time or the inclination to sit down and understand what a bill is meant to accomplish. People have access to the information, they just don't have access to the abridged version of that information.

Open source governance would help to change that by first bringing together individuals and interest groups (such as the Sunlight Foundation[http://www.sunlightfoundation.com/]) who do have the patience to analyze bills and riders. By cooperating and collaborating, these individuals can better coordinate their efforts and disseminate their findings to a wider audience. Once a larger percentage of the the general population is more aware of what is contained in the bills, they will be better informed and be able to make sound decisions on whether or not they support what sorts of things are included in the bills.

In theory, this would reduce the amount of riders that get passed through, because law-makers would have a more difficult time passing things through that might not necessarily have popular support. At a minimum, they would be more mindful of what sorts of things they choose to include in a bill because a responsive and well-informed populace would quickly voice their opposition to anything objectionable.

==Additional Links==
* http://thomas.loc.gov/home/abt_thom.html
* http://www.lessig.org/blog/
* http://www.archives.gov/nhprc/announcement/digitizing-faqs.html
* http://www.sunlightfoundation.com/

CSC 379 SUM2008:Week 4, Group 2

2008-08-01T20:57:39Z

Mwmccask: /* Benefits */

==Open Government==
Most bills are passed by legislatures without ever being read by most legislators. Letters, articles, reports, all often never escape the physical mediums (paper) of their existence. Although technology has developed to the point where all non-private information in the United States government can, in theory, be made openly available, the support structures and culture of information sharing has not caught up to make full use of them. Efforts are being made to use digitization and sharing technology; one of the most notable digitization efforts is THOMAS, a joint effort by the Library of Congress and the Government Printing Office (GPO).

Examine the ethical implications of making policy with inadequate access to information, and the efforts being made to address those concerns. Is there a need for a change in existing support structures and culture of information sharing in government? Should support structures and culture change to encourage greater information sharing, if it required the government to slow down decision-making processes?
==History==
Open government is the doctrine that all levels of political administration should be open to public viewing and scrutiny. The origins of which date back to the Enlightenment in Europe in the eighteenth century. More recently, the passing of the [http://www.usdoj.gov/oip/ Freedom of Information Act (FOIA)] in the United States in 1966 is seen as the beginning of a modern movement toward open government. After its passing, several countries have followed suit in the subsequent decades.

The FOIA allows for complete or partial disclosure of previously unreleased information and documents from the US Government based on a series of conditions. It applies to all government agencies. There are nine exemptions to the FOIA:
*Classified national defense and foreign relations information
*Internal agency rules and practices
*Information that is prohibited from disclosure by another federal law
*Trade secrets and other confidential business information
*Inter-agency or intra-agency communications protected by legal privileges
*Information involving matters of personal privacy
*Records compiled for law enforcement purposes
*Information relating to the supervision of financial institutions
*Geological information on wells

[http://thomas.loc.gov/ THOMAS] is a database kept by the Library of Congress detailing legislative information since 1995. The database is named after Thomas Jefferson. It includes information including:
*Bills and resolutions
*Congressional activity
*Congressional record
*Committee information
*Treaties
*Historical documents

A new political philosophy is [http://en.wikipedia.org/wiki/Open_source_governance open source governance], which details a post-national state where any interested citizen can add to the creation of a policy, by way of a wiki or another mechanism. The core of such a government structure is a "central codebase" that are maintained by public registry. The policies are distributed to local areas that can alter the policy for their own uses and can send improvements back to the core.

== Benefits ==

One of the advantages of an open source government is that more of the government's actions and intentions become transparent by posting reports about said activity in a widely accessible place (such as the internet). This gives a much wider range of people the opportunity to decide for themselves if they actually support what their leaders and representatives are doing.

For example, one common problem with bills is that they typically get "riders," which are extra provisions that are appended to the bill and may or may not have anything to do with the original intent of the bill. Typically they are used to covertly pass items through the bill-approval process that would otherwise be met with opposition. At this time, the threat of being discovered is minimal because the riders tend to be written in a very verbose, jargon-fill manner, which very few people are willing to examine and interpret.

It is not really a question of how to obtain access to information about these bills and various attachments. All of this information is available to the general public (e.g. via [http://thomas.loc.gov/home/abt_thom.htmlTHOMAS]); anyone is well within their bounds to perform their own research. It is more a question of how to obtain access to this information that is easily digestible and understandable. As stated, the wording of bills can be very confusing. Not everyone has the time or the inclination to sit down and understand what a bill is meant to accomplish. People have access to the information, they just don't have access to the abridged version of that information.

Open source governance would help to change that by first bringing together individuals and interest groups (such as the Sunlight Foundation[http://www.sunlightfoundation.com/]) who do have the patience to analyze bills and riders. By cooperating and collaborating, these individuals can better coordinate their efforts and disseminate their findings to a wider audience. Once a larger percentage of the the general population is more aware of what is contained in the bills, they will be better informed and be able to make sound decisions on whether or not they support what sorts of things are included in the bills.

In theory, this would reduce the amount of riders that get passed through, because law-makers would have a more difficult time passing things through that might not necessarily have popular support. At a minimum, they would be more mindful of what sorts of things they choose to include in a bill because a responsive and well-informed populace would quickly voice their opposition to anything objectionable.

==Additional Links==
* http://thomas.loc.gov/home/abt_thom.html
* http://www.lessig.org/blog/
* http://www.archives.gov/nhprc/announcement/digitizing-faqs.html
* http://www.sunlightfoundation.com/

CSC 379 SUM2008:Week 4, Group 2

2008-08-01T20:50:22Z

Mwmccask: /* Benefits */

==Open Government==
Most bills are passed by legislatures without ever being read by most legislators. Letters, articles, reports, all often never escape the physical mediums (paper) of their existence. Although technology has developed to the point where all non-private information in the United States government can, in theory, be made openly available, the support structures and culture of information sharing has not caught up to make full use of them. Efforts are being made to use digitization and sharing technology; one of the most notable digitization efforts is THOMAS, a joint effort by the Library of Congress and the Government Printing Office (GPO).

Examine the ethical implications of making policy with inadequate access to information, and the efforts being made to address those concerns. Is there a need for a change in existing support structures and culture of information sharing in government? Should support structures and culture change to encourage greater information sharing, if it required the government to slow down decision-making processes?
==History==
Open government is the doctrine that all levels of political administration should be open to public viewing and scrutiny. The origins of which date back to the Enlightenment in Europe in the eighteenth century. More recently, the passing of the [http://www.usdoj.gov/oip/ Freedom of Information Act (FOIA)] in the United States in 1966 is seen as the beginning of a modern movement toward open government. After its passing, several countries have followed suit in the subsequent decades.

The FOIA allows for complete or partial disclosure of previously unreleased information and documents from the US Government based on a series of conditions. It applies to all government agencies. There are nine exemptions to the FOIA:
*Classified national defense and foreign relations information
*Internal agency rules and practices
*Information that is prohibited from disclosure by another federal law
*Trade secrets and other confidential business information
*Inter-agency or intra-agency communications protected by legal privileges
*Information involving matters of personal privacy
*Records compiled for law enforcement purposes
*Information relating to the supervision of financial institutions
*Geological information on wells

[http://thomas.loc.gov/ THOMAS] is a database kept by the Library of Congress detailing legislative information since 1995. The database is named after Thomas Jefferson. It includes information including:
*Bills and resolutions
*Congressional activity
*Congressional record
*Committee information
*Treaties
*Historical documents

A new political philosophy is [http://en.wikipedia.org/wiki/Open_source_governance open source governance], which details a post-national state where any interested citizen can add to the creation of a policy, by way of a wiki or another mechanism. The core of such a government structure is a "central codebase" that are maintained by public registry. The policies are distributed to local areas that can alter the policy for their own uses and can send improvements back to the core.

== Benefits ==

One of the advantages of an open source government is that more of the government's actions and intentions become transparent by posting reports about said activity in a widely accessible place (such as the internet). This gives a much wider range of people the opportunity to decide for themselves if they actually support what their leaders and representatives are doing.

For example, one common problem with bills is that they typically get "riders," which are extra provisions that are appended to the bill and may or may not have anything to do with the original intent of the bill. Typically they are used to covertly pass items through the bill-approval process that would otherwise be met with opposition. At this time, the threat of being discovered is minimal because the riders tend to be written in a very verbose, jargon-fill manner, which very few people are willing to examine and interpret.

Open source governance would help to change that by first bringing together individuals and interest groups who do have the patience to analyze bills and riders. By cooperating and collaborating, these individuals can better coordinate their efforts and disseminate their findings to a wider audience. Once a larger percentage of the the general population is more aware of what is contained in the bills, they will be better informed and be able to make sound decisions on whether or not they support what sorts of things are included in the bills.

In theory, this would reduce the amount of riders that get passed through, because law-makers would have a more difficult time passing things through that might not necessarily have popular support. At a minimum, they would be more mindful of what sorts of things they choose to include in a bill because a responsive and well-informed populace would quickly voice their opposition to anything objectionable.

==Additional Links==
* http://thomas.loc.gov/home/abt_thom.html
* http://www.lessig.org/blog/
* http://www.archives.gov/nhprc/announcement/digitizing-faqs.html
* http://www.sunlightfoundation.com/

CSC 379 SUM2008:Week 4, Group 2

2008-08-01T20:46:56Z

Mwmccask: /* Benefits */

==Open Government==
Most bills are passed by legislatures without ever being read by most legislators. Letters, articles, reports, all often never escape the physical mediums (paper) of their existence. Although technology has developed to the point where all non-private information in the United States government can, in theory, be made openly available, the support structures and culture of information sharing has not caught up to make full use of them. Efforts are being made to use digitization and sharing technology; one of the most notable digitization efforts is THOMAS, a joint effort by the Library of Congress and the Government Printing Office (GPO).

Examine the ethical implications of making policy with inadequate access to information, and the efforts being made to address those concerns. Is there a need for a change in existing support structures and culture of information sharing in government? Should support structures and culture change to encourage greater information sharing, if it required the government to slow down decision-making processes?
==History==
Open government is the doctrine that all levels of political administration should be open to public viewing and scrutiny. The origins of which date back to the Enlightenment in Europe in the eighteenth century. More recently, the passing of the [http://www.usdoj.gov/oip/ Freedom of Information Act (FOIA)] in the United States in 1966 is seen as the beginning of a modern movement toward open government. After its passing, several countries have followed suit in the subsequent decades.

The FOIA allows for complete or partial disclosure of previously unreleased information and documents from the US Government based on a series of conditions. It applies to all government agencies. There are nine exemptions to the FOIA:
*Classified national defense and foreign relations information
*Internal agency rules and practices
*Information that is prohibited from disclosure by another federal law
*Trade secrets and other confidential business information
*Inter-agency or intra-agency communications protected by legal privileges
*Information involving matters of personal privacy
*Records compiled for law enforcement purposes
*Information relating to the supervision of financial institutions
*Geological information on wells

[http://thomas.loc.gov/ THOMAS] is a database kept by the Library of Congress detailing legislative information since 1995. The database is named after Thomas Jefferson. It includes information including:
*Bills and resolutions
*Congressional activity
*Congressional record
*Committee information
*Treaties
*Historical documents

A new political philosophy is [http://en.wikipedia.org/wiki/Open_source_governance open source governance], which details a post-national state where any interested citizen can add to the creation of a policy, by way of a wiki or another mechanism. The core of such a government structure is a "central codebase" that are maintained by public registry. The policies are distributed to local areas that can alter the policy for their own uses and can send improvements back to the core.

== Benefits ==

One of the advantages of an open source government is that more of the government's actions and intentions become transparent, giving everyone an opportunity to decide for themselves if they actually support what their leaders and representatives are doing.

For example, one common problem with bills is that they typically get "riders," which are extra provisions that are appended to the bill and may or may not have anything to do with the original intent of the bill. Typically they are used to covertly pass items through the bill-approval process that would otherwise be met with opposition. At this time, the threat of being discovered is minimal because the riders tend to be written in a very verbose, jargon-fill manner, which very few people are willing to examine and interpret.

Open source governance would help to change that by first bringing together individuals and interest groups who do have the patience to analyze bills and riders. By cooperating and collaborating, these individuals can better coordinate their efforts and disseminate their findings to a wider audience. Once a larger percentage of the the general population is more aware of what is contained in the bills, they will be better informed and be able to make sound decisions on whether or not they support what sorts of things are included in the bills.

In theory, this would reduce the amount of riders that get passed through, because law-makers would have a more difficult time passing things through that might not necessarily have popular support. At a minimum, they would be more mindful of what sorts of things they choose to include in a bill because a responsive and well-informed populace would quickly voice their opposition to anything objectionable.

==Additional Links==
* http://thomas.loc.gov/home/abt_thom.html
* http://www.lessig.org/blog/
* http://www.archives.gov/nhprc/announcement/digitizing-faqs.html
* http://www.sunlightfoundation.com/

CSC 379 SUM2008:Week 4, Group 2

2008-08-01T20:46:18Z

Mwmccask: /* History */

==Open Government==
Most bills are passed by legislatures without ever being read by most legislators. Letters, articles, reports, all often never escape the physical mediums (paper) of their existence. Although technology has developed to the point where all non-private information in the United States government can, in theory, be made openly available, the support structures and culture of information sharing has not caught up to make full use of them. Efforts are being made to use digitization and sharing technology; one of the most notable digitization efforts is THOMAS, a joint effort by the Library of Congress and the Government Printing Office (GPO).

Examine the ethical implications of making policy with inadequate access to information, and the efforts being made to address those concerns. Is there a need for a change in existing support structures and culture of information sharing in government? Should support structures and culture change to encourage greater information sharing, if it required the government to slow down decision-making processes?
==History==
Open government is the doctrine that all levels of political administration should be open to public viewing and scrutiny. The origins of which date back to the Enlightenment in Europe in the eighteenth century. More recently, the passing of the [http://www.usdoj.gov/oip/ Freedom of Information Act (FOIA)] in the United States in 1966 is seen as the beginning of a modern movement toward open government. After its passing, several countries have followed suit in the subsequent decades.

The FOIA allows for complete or partial disclosure of previously unreleased information and documents from the US Government based on a series of conditions. It applies to all government agencies. There are nine exemptions to the FOIA:
*Classified national defense and foreign relations information
*Internal agency rules and practices
*Information that is prohibited from disclosure by another federal law
*Trade secrets and other confidential business information
*Inter-agency or intra-agency communications protected by legal privileges
*Information involving matters of personal privacy
*Records compiled for law enforcement purposes
*Information relating to the supervision of financial institutions
*Geological information on wells

[http://thomas.loc.gov/ THOMAS] is a database kept by the Library of Congress detailing legislative information since 1995. The database is named after Thomas Jefferson. It includes information including:
*Bills and resolutions
*Congressional activity
*Congressional record
*Committee information
*Treaties
*Historical documents

A new political philosophy is [http://en.wikipedia.org/wiki/Open_source_governance open source governance], which details a post-national state where any interested citizen can add to the creation of a policy, by way of a wiki or another mechanism. The core of such a government structure is a "central codebase" that are maintained by public registry. The policies are distributed to local areas that can alter the policy for their own uses and can send improvements back to the core.

== Benefits ==

One of the advantages of an open government is that more of the government's actions and intentions become transparent, giving everyone an opportunity to decide for themselves if they actually support what their leaders and representatives are doing.

For example, one common problem with bills is that they typically get "riders," which are extra provisions that are appended to the bill and may or may not have anything to do with the original intent of the bill. Typically they are used to covertly pass items through the bill-approval process that would otherwise be met with opposition. At this time, the threat of being discovered is minimal because the riders tend to be written in a very verbose, jargon-fill manner, which very few people are willing to examine and interpret.

Open government would help to change that by first bringing together individuals and interest groups who do have the patience to analyze bills and riders. By cooperating and collaborating, these individuals can better coordinate their efforts and disseminate their findings to a wider audience. Once a larger percentage of the the general population is more aware of what is contained in the bills, they will be better informed and be able to make sound decisions on whether or not they support what sorts of things are included in the bills.

In theory, this would reduce the amount of riders that get passed through, because law-makers would have a more difficult time passing things through that might not necessarily have popular support. At a minimum, they would be more mindful of what sorts of things they choose to include in a bill because a responsive and well-informed populace would quickly voice their opposition to anything objectionable.

==Additional Links==
* http://thomas.loc.gov/home/abt_thom.html
* http://www.lessig.org/blog/
* http://www.archives.gov/nhprc/announcement/digitizing-faqs.html
* http://www.sunlightfoundation.com/

CSC 379 SUM2008:Week 4, Group 2

2008-08-01T20:46:07Z

Mwmccask: /* Benefits */

==Open Government==
Most bills are passed by legislatures without ever being read by most legislators. Letters, articles, reports, all often never escape the physical mediums (paper) of their existence. Although technology has developed to the point where all non-private information in the United States government can, in theory, be made openly available, the support structures and culture of information sharing has not caught up to make full use of them. Efforts are being made to use digitization and sharing technology; one of the most notable digitization efforts is THOMAS, a joint effort by the Library of Congress and the Government Printing Office (GPO).

Examine the ethical implications of making policy with inadequate access to information, and the efforts being made to address those concerns. Is there a need for a change in existing support structures and culture of information sharing in government? Should support structures and culture change to encourage greater information sharing, if it required the government to slow down decision-making processes?
==History==
Open government is the doctrine that all levels of political administration should be open to public viewing and scrutiny. The origins of which date back to the Enlightenment in Europe in the eighteenth century. More recently, the passing of the [http://www.usdoj.gov/oip/ Freedom of Information Act (FOIA)] in the United States in 1966 is seen as the beginning of a modern movement toward open government. After its passing, several countries have followed suit in the subsequent decades.

The FOIA allows for complete or partial disclosure of previously unreleased information and documents from the US Government based on a series of conditions. It applies to all government agencies. There are nine exemptions to the FOIA:
*Classified national defense and foreign relations information
*Internal agency rules and practices
*Information that is prohibited from disclosure by another federal law
*Trade secrets and other confidential business information
*Inter-agency or intra-agency communications protected by legal privileges
*Information involving matters of personal privacy
*Records compiled for law enforcement purposes
*Information relating to the supervision of financial institutions
*Geological information on wells

[http://thomas.loc.gov/ THOMAS] is a database kept by the Library of Congress detailing legislative information since 1995. The database is named after Thomas Jefferson. It includes information including:
*Bills and resolutions
*Congressional activity
*Congressional record
*Committee information
*Treaties
*Historical documents

A new political philosophy is [http://en.wikipedia.org/wiki/Open_source_governance open source governance], which details a post-national state where any interested citizen can add to the creation of a policy, by way of a wiki or another mechanism. The core of such a government structure is a "central codebase" that are maintained by public registry. The policies are distributed to local areas that can alter the policy for their own uses and can send improvements back to the core.

== Benefits ==

One of the advantages of an open government is that more of the government's actions and intentions become transparent, giving everyone an opportunity to decide for themselves if they actually support what their leaders and representatives are doing.

For example, one common problem with bills is that they typically get "riders," which are extra provisions that are appended to the bill and may or may not have anything to do with the original intent of the bill. Typically they are used to covertly pass items through the bill-approval process that would otherwise be met with opposition. At this time, the threat of being discovered is minimal because the riders tend to be written in a very verbose, jargon-fill manner, which very few people are willing to examine and interpret.

Open government would help to change that by first bringing together individuals and interest groups who do have the patience to analyze bills and riders. By cooperating and collaborating, these individuals can better coordinate their efforts and disseminate their findings to a wider audience. Once a larger percentage of the the general population is more aware of what is contained in the bills, they will be better informed and be able to make sound decisions on whether or not they support what sorts of things are included in the bills.

In theory, this would reduce the amount of riders that get passed through, because law-makers would have a more difficult time passing things through that might not necessarily have popular support. At a minimum, they would be more mindful of what sorts of things they choose to include in a bill because a responsive and well-informed populace would quickly voice their opposition to anything objectionable.

==Additional Links==
* http://thomas.loc.gov/home/abt_thom.html
* http://www.lessig.org/blog/
* http://www.archives.gov/nhprc/announcement/digitizing-faqs.html
* http://www.sunlightfoundation.com/

CSC 379 SUM2008:Week 4, Group 2

2008-08-01T20:29:51Z

Mwmccask: /* History */

Encryption

2008-08-01T02:52:36Z

Mwmccask: /* Examples of Encryption Software */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ GnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key Escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T02:47:54Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key Escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.[http://www.washingtonpost.com/wp-srv/politics/special/encryption/stories/limits091798.htm]

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T02:45:58Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key Escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

The general trend in the US has been a push for less government interference into privately-owned encryption services, whereas government control has remained comparatively higher in other countries. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T02:44:24Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key Escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results. One rather famous moment occurred in 1993, when the US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

The general trend in the US has been a push for less government interference into privately-owned encryption services. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T02:43:31Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key Escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

=== Role of Government ===

There have been sporadic attempts at governmental intervention in the past, often with mixed results.

In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

The general trend in the US has been a push for less government interference into privately-owned encryption services. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T02:43:12Z

Mwmccask: /* Problems */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.
*''Key Escrowing'' - A variation of key recovery, this is essentially a set-up wherein a person can grant their key to a third party that requires their information (e.g. a private company or a government entity). The third party typically has to present authorization and a compelling reason for needing that access. It is still a controversial topic due to the very nature of third-party access that would be necessary, and to date no one has come up with a sufficiently secure system that was not technically complex.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been sporadic attempts at governmental intervention in the past, often with mixed results.

In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

The general trend in the US has been a push for less government interference into privately-owned encryption services. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T02:40:08Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been sporadic attempts at governmental intervention in the past, often with mixed results.

In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

The general trend in the US has been a push for less government interference into privately-owned encryption services. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T02:33:33Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been various attempts at governmental intervention in the past, often with mixed results.

*''Previous Restrictions'' - In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

The general trend in the US has been a push for less government interference into privately-owned encryption services. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines
*[http://www.csl.sri.com/users/neumann/judiciary.html ''Security Risks in Key Recovery''] by Peter Neumann

Encryption

2008-08-01T00:12:29Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been various attempts at governmental intervention in the past, often with mixed results.

*''Previous Restrictions'' - In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

The general trend in the US has been a push for less government interference into privately-owned encryption services. The debate is far from over, however.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-08-01T00:09:55Z

Mwmccask: /* Examples of Encryption Software */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

=== Examples of Encryption Software ===

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*''Previous Restrictions'' - In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-08-01T00:09:38Z

Mwmccask: /* Examples of Encryption Software */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.
*[http://www.gnupg.org/ BnuPG] - Another free data and communications encryption program that typically comes packaged with open source software such as Linux OS's. It uses some public-key techniques, but for the most part uses unpatented encryption methods.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*''Previous Restrictions'' - In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-08-01T00:04:36Z

Mwmccask: /* What is Encryption? */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

In terms of software, key complexity or length refers to how long the binary string representation of that key is. This length is measured in individual 1's and 0's, known as bits. Since there are only two possible values for a single bit, adding just one more bit to the key gives it twice as many possible combinations. A key that is 2 bits long, for example, has 4 possible values it can be, while a 3-bit key has 8 possible values. In the US, keys are typically 128 bits long, if not longer. This results in 2^128 combinations, meaning that the likelihood of correctly guessing the key is very small.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*''Previous Restrictions'' - In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-07-31T23:59:56Z

Mwmccask: /* Problems */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US 128-bit encryption or higher is not uncommon, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*''Previous Restrictions'' - In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-07-31T23:59:12Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US encryption is 128-bit, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*''Previous Restrictions'' - In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-07-31T23:58:45Z

Mwmccask: /* Role of Government */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US encryption is 128-bit, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.
*''Key Recovery'' -
*''Key Escrowing'' -

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-07-31T23:57:26Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US encryption is 128-bit, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

Ethical Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://itlaw.wikia.com/wiki/Encryption ''ITLaw.Wikia Entry on Encryption'']

General Discussion
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-07-31T23:49:15Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US encryption is 128-bit, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson
*[http://library.findlaw.com/1997/Jul/1/126870.html ''Piecing Together the Encryption Puzzle''] by Paul, Hastings, Janofsky & Walker

General Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines

Encryption

2008-07-31T23:43:47Z

Mwmccask: /* Additional Resources */

= Study Guide =

== What is Encryption? ==

Encryption, in the context of software, is process by which data in a computer can be encoded in such a way that no one can determine its original value, save for the original owner of the data and whoever he or she sees fit. In this manner, private or sensitive data can be protected without having to physically deny access to the medium that holds the data (e.g. a server).

In general, encryption consists of three items: the original data, the encryption algorithm known as the cypher, and the "solution" to that algorithm called the key. The cypher uses instructions provided by the key to perform an operation on the data, giving it a new value that does not yield any useful information about the original state of the data. At first glance, the new data may appear to simply be gibberish or random noise. In this state, the data is said to be encrypted. To decrypt the data, one simply has to plug the key back into the cypher and run the operations in reverse.

It is not impossible to perform the decryption without the key, but if the key is of sufficient complexity or length, even a brute-force approach may require an impractical amount of time. It is for this reason that most clients can be certain that their data will not be compromised. It is also for this reason that clients need to take care that their key is only provided to people that they want to share the data with.

== Examples of Encryption Software ==

* [http://www.pgpi.org/ PGP-]Originally used only to encrypt email messages and attachments, but has since diversified into several applications, including disk encryption for laptops and IM sessions. It is built upon public-key encryption technology[http://www.webopedia.com/TERM/P/public_key_cryptography.html].
*[http://about.skype.com/ Skype] - Provides telephone services over the internet. Uses several different encryption methods, including RSA. The encryption cannot be disabled by the user, and is managed automatically.

== Issues With Encryption ==

=== Problems ===

While encryption is very secure if managed properly, it is not fool-proof. It also comes with some of its own inherent disadvantages. There are many factors that you should consider before deciding to use encryption to protect your data:

* ''Protecting the key'' - If an unauthorized person manages to acquire your key, that person can access your data at will, without your knowledge. It does not even necessarily have to be your key; if you share your key with other trusted persons, they can also a copy of the key to escape, accidentally or not. Programs that use public-key encryption have largely eliminated this problem, however.
*''Using sufficient key strength'' - If a key is not large enough, the worst-case time required to perform a decryption via brute force is small. In the US encryption is 128-bit, which is more than sufficient, but in other countries it may be as low as 40.
*''The process can be slow'' - Depending upon how much data there is and how often you need to access it, constant decryption and re-encryption can lead to longer access times. This may cause some people to consider it an annoyance and forgo it.

=== Ethical Considerations ===

While encryption can be used to protect important but otherwise harmless data such as financial records, there equally exists the possibility that it can be used to hide illegal or malicious data. An obvious example is child pornography. If someone with illegal data were being investigated, nobody could ever prove that they have that data if they never offered the key. Another potential scenario is that two people who are conspiring to commit a crime, terrorist act, etc can do so in safety over the internet via encrypting their exchanges. This raises concerns over whether or not encryption should be regulated and controlled. If investigators needed access to an encrypted computer, they would have a much easier time if the owner was legally required to give them the key if requested.

But then this enters into other sensitive issues, primarily one of privacy vs. security. If authorities are allowed to access your private data at will, then the purpose of the encryption is rendered null. Someone would have to determine what kinds of encryption are acceptable and what kinds are not, and define what the criteria for acceptability would be.

== Role of Government ==

There have been attempts at governmental intervention in the past, often with mixed results.

*In 1993, he US federal government attempted to mount a case against Philip Zimmermann, the creator of PGP. At the time, encryption was legally considered a "munition," and therefore had its exportation restricted. The case was ultimately thrown out after Zimmermann convinced the court that software can be printed in books, and is therefore protected under the 1st Amendment. A couple of years later, the federal government substantially reduced its restrictions upon encryption software and disqualified it as a munition.

= Additional Resources =

General Info
*[http://en.wikipedia.org/wiki/Encryption ''Wikipedia Entry on Encryption'']
*[http://computer.howstuffworks.com/encryption.htm ''How Encryption Works''] by Jeff Tyson

General Discussion
*[http://ezinearticles.com/?Ethical-Considerations-of-Privacy-and-Cyber-Medical-Information&id=1077289 ''Ethical Considerations of Privacy and Cyber-Medical Information''] by Jonathan Klemens
*[http://www.nysscpa.org/cpajournal/2008/508/essentials/p62.htm ''Ethical Considerations for Providing Professional Services Online''] by J.H. Yamamura and F.H. Grupe
*[http://www.dslreports.com/shownews/Your-Encryption-Key-a-Fifth-Amendment-Right-90282 ''Your Encryption Key a Fifth Amendment Right?'']
*[http://www.wired.com/news/technology/0,70524-0.html?tw=wn_index_1 ''A Pretty Good Way to Foil the NSA''] by Ryan Singel
*[http://www.nytimes.com/2006/05/22/technology/22privacy.html ''Voice Encryption May Draw U.S. Scrutiny''] by John Markoff

For Government Regulation
*[http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1238490,00.html ''Federal government pushes full-disk encryption''] by Dennis Fisher
*[http://blogs.computerworld.com/federal_encryption_standardization ''Federal encryption standardization''] by Douglas Schweitzer
*[http://securityblog.typepad.com/technology_security/2007/06/government_buys.html ''Government buys encryption''] by Michael Mongold

Against Government Regulation
*[http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA392334 ''Constitutional Conflicts with Encryption Regulation''] by Regina Winchester

These will be sorted later on.
*[http://www.technewsworld.com/story/60102.html ''The University's Role in Advancing Data Encryption, Part 2''] by Andrew Burger
*[http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/07/12/19/Unlocking-encryption-management_1.html ''Unlocking encryption management''] by Matt Hines