When I discussed Password Policies, I talked about the one-way encryption used to store passwords but more generally you want to encrypt something to make it private and later decrypt it to use it. Here I’ll try to give a basic idea of how that works. Again the real math is hard but a useful understanding is not.

Substitution

A very simple example of protecting a message is a substitution cipher where each letter of a message is replaced by a different letter using a plan agreed upon by the sender and receiver of the message. You’ll find substitution in the secret decoder rings of yore and the rot13 (rotate 13) algorithm. In rot13, every letter is replaced by the one 13 letters later in the alphabet (wrapping around to A from the second half of the alphabet). A becomes N, B becomes O, and P becomes C.

A message enciphered with rot13 can be decoded either by applying rot13 again or by reversing it.

Encode: BLOCK + 13 = OYBPX
Reverse: OYBPX – 13 = BLOCK
Encode: OYBPX + 13 = BLOCK

Such simple encoding is easy to understand and implement and the message doesn’t change size when it is encoded, but substitution ciphers are easily broken based on the well-known frequency of letters in English text. Given a message of any significant size, we can look for the most frequent letter and be fairly sure that it is a substitute for E. T is the next most common letter. Then if we see “TXE” we can guess that X represents H. Clearly we need something stronger to keep your online banking safe and private.

How Keys Work

If you think of a key as something that gives you access, a computer password is a sort of key. Unfortunately, passwords are the skeleton keys of computer security. It is possible to make passwords long and complex, but then they are hard to remember or type. However, computers often excel at things people don’t do well and remembering long, meaningless strings of characters is one of those tasks. The state of the art in encryption is called Public Key Infrastructure and it takes advantage of this strength of computers.

The software that secures your session with your bank’s website manipulates very long keys to encrypt and decrypt the data flowing between your computer and the bank. The keys look something like:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZ2R9o2S7n86yV4X23yG3gD/xWzZ0FdCNHPmhogm
Lh+/batLhfkXBZxR7bUrjVe0Lwr+JrdT0czQp6DGZLhjiGsAihKFTbvvyowFoLLcH34/KisTTj6k1m
BFNU/oAUyHd74SZdmnaU3qnZ6QmYylxavN67TWjcPuzepiGwvmv3dpXrPr76qKRG/+huac9fZ04Ld5
tZRUkoILOPWh5+WJ4Ak7mx5652QVWT2MloGxW+qHr3RCoUEAklXdUSkC8HsOv0np8Q4NK7UFC+l+yh
t37+AL8IOe7j9HiPovoY+OVB99F472QywjrOiDzHR27dgs8YrYJ5QqGckd8v2McS2i83 chris@chris-XPS-99-1234

Keys used in this way are generated as a pair, one which is kept private and one which can be freely shared. In the rot13 example above, the same “key” (13) was used to encode and decode. But what if you used 12 to encode and told your friend to use 14 to decode. C + 12 = O and O + 14 (wrapped around at Z) = C.

Public/private key pairs are useful because the math involved in creating and using them makes them only work going forward.

• With a rot13-like encoding, there are two keys that may be used to decode a message (you can subtract the encoding key or add the decoding key). Public/private key pairs don’t work like that; a message encoded with the private key can only be decoded with the public key. Knowing the private key does not allow you to reverse the encryption.
• With rot13-like encoding, you know that the two keys must add up to 26, so if I tell you to decode with 14, you know I encoded with 12. There is no such simple relationship between the keys in a public/private pair.

A few examples may help. I’ll illustrate encryption as if it was addition but the “+” is meant to represent a sort of vague “combines with.”

Start with some data (a stock report or a love letter or whatever) and a public/private key pair. Combine the data with the private key and you get what appears to be gibberish:

Data
+ Private Key
Gibberish

You can’t use the private key to get the data back from the gibberish, rather you combine the public key with the gibberish to get back the data:

Gibberish
+ Public Key
Data

So, if I want to send you a message securely, I can give you my public key, encrypt the message with my private key, and send it to you. Not only is the message in transit gibberish, but you will know that the message came from me because my public key can only decrypt a message encrypted with my private key.

Of course, if my public key is public, anyone might have it and be able to intercept the gibberish and decrypt it on their computer. There is one more property of the key pair that helps us: data encrypted with one can be decrypted with the other. Knowing that, I can do:

Data
+ My Private Key
My Gibberish
+ Your Public Key
My Gibberish for You

And when you get it you can do:

My Gibberish for You
+ Your Private Key
My Gibberish
+ My Public Key
Data

Certificate Authorities

Individuals and organizations can and do create their own keys, but most people don’t want to be bothered. It’s a truism of computer security that if the system is hard, it won’t be used.

It’s more complicated than this, but essentially the technology industry has agreed to trust a few organizations called Certificate Authorities (or CAs) to generate keys. Anyone who wants to secure their communication goes to a CA, proves their identity, and asks for a pair of keys. The CA generates the keys, sends the private key to the requestor and prepares a digital certificate that says, “This public key belongs to this organization.”

Software makers who want to provide secure communication build into their software a list of CAs. When a browser starts a session with a new website, the site sends a certificate and tells the browser which CA signed it. The browser then uses the CA’s public key to verify the signature. If it all checks out, you’re connected.

But it may not all check out. Keys expire. Partly because CAs charge for them and want recurring revenue, but also because it provides some additional level of security. And keys can be stolen or leaked. When it’s a signing certificate used by a CA, all the certificates issued by that CA are compromised and a lot of people work fast to fix the security hole.

Learning More

In this post, and when talking about passwords, I’ve taken some liberties while giving you a way to think about a complicated topic in a simple way. If you are curious about the real details, I recommend Cryptography Engineering. It is deeper and more accurate, yet still mostly avoids complex mathematics.

When you see a sign promising “free Wi-Fi” do you think, “Great, now I don’t have to burn my data plan”? If that’s all you see, you should be thinking, “That’s not safe!” In the next few paragraphs, I’ll try to explain why.

Pick the Right Network

As you approach the gate, you see a sign that says the airport has free wireless internet. You have some time before your flight so you open open the Wi-Fi network settings on your phone, find an access point named “Free Airport Wi-Fi” and you connect. But wherever there is a cluster of businesses, there is a storm of Wi-Fi signals and it’s often difficult to tell which one to use. Maybe you should pick “Airport Wireless” or “TWC Guest Wi-Fi.” It may be that all the signals come from legitimate services but it isn’t hard for someone to set up a fake access point and listen in on your searches, or music streaming, or email exchanges, or banking. It’s called a “man in the middle attack” and it can be tough to detect.

What happens is you connect to the fake access point and it connects to some other internet service. Your network traffic is received by the Bad Guy, recorded or processed and also forwarded to the intended recipient. Responses go by the same route in reverse. Your passwords and other sensitive information are no longer private.

Rule 1: Only connect to Wi-Fi provided by someone you trust who provides you the name.

Secure the Connection

You get to your doctor’s office or hair salon and there’s a sign that tells you the name of the Wi-Fi access point they provide for their patients or customers. That’s a big step forward from “Free Wi-Fi Available” but is it enough? Not really. The connection between your phone or computer and the Wi-Fi access point is radio signals flying through the air and anyone who can receive them can eavesdrop on your network usage. The answer to that is to encrypt the connection and that is done by providing a password or key. The cryptography is beyond the scope of this post but, essentially, the Wi-Fi protocols use the key (which is the same for everyone) and some other information to make a different encrypted channel for each user. As a result, even though someone else knows the password and can receive your signals, those signals are just gibberish to them.

Rule 2: Only use Wi-Fi when it is secured with a password provided by someone you trust.

A Password is Not Enough

Don’t be lulled into a false sense of security if you see only a password posted.  It might be okay if there is only a single access point available but more likely you’ll see many. While one may be legitimate, any other might be a hacker who has set up access with the same password and is waiting to steal your data.

Enjoy Your Coffee

You take your latte and your laptop and find a table at your favorite coffee shop. There’s a sign on the wall telling you the name of their Wi-Fi access point and the password you need to connect. Is it safe? Likely. You and your host have done all you can to make your wireless networking as secure as practical. Their router could be infected with malware, your bank or email provider may have been hacked, or any number of other things beyond your control could still make your digital life difficult but go ahead. Connect and log on using your strong password. You do have a strong password, right? We’ll leave that discussion for another day.

Rules for Network Providers

Providing free Wi-Fi to your customers is a service. But please do it right and don’t put them and their information at risk. It’s not hard.

1. Give your access point a clear, specific name. Don’t be generic like “Free Wi-Fi” and don’t accept the default name that your router provides.
2. Enable the highest level of Wi-Fi security your router provides. Today that’s likely WPA2 but WPA3 is coming.
3. Set a clear password for your access point. Unlike login passwords, Wi-Fi passwords don’t need to be complex or obscure.
4. Clearly display the name of the access point and the password on a professional-looking sign. A wrinkled piece of copier paper might have been taped up by a visiting Bad Guy.
5. Don’t make me land on an advertising page when I connect. (OK, that last one is just my personal pet peeve. But really. Just cut it out.)