Encryption

Why encryption matters more on wireless than wired networks

Both wired and wireless networks need encryption, but wireless networks are especially exposed because the signal travels through the air and can be picked up by any nearby radio receiver. Anyone within range of a Wi-Fi access point can in principle capture the radio waves. On a wired network, an attacker would have to physically tap into the cable to intercept anything.

Wireless networks therefore use dedicated security protocols such as WPA2 (Wi-Fi Protected Access 2) to encrypt all traffic between the device and the access point.

How a Wi-Fi network encrypts data

A typical wireless connection works like this:

1. The Wi-Fi network is identified by an SSID (Service Set Identifier), which is the name of the network.
2. The user enters the SSID and a password when joining the network.
3. The SSID and password are combined to derive a master key.
4. Every device on the network has the same master key.
5. The master key never travels across the network. Lacking the key, an eavesdropper sees the captured packets only as scrambled bytes.
6. Data sent from a device is encrypted with the master key into ciphertext before transmission.
7. The receiving end decrypts the ciphertext using the same master key.

2. Two big families: symmetric vs asymmetric

Modern encryption splits into two big families, distinguished by how many keys are used.

The next two sections look at each family in turn.

3. Symmetric encryption

Symmetric encryption uses the same secret key to encrypt and decrypt. Both the sender and the receiver must have a copy of this key.

How it works

1. The sender and receiver agree on a secret key ahead of time, through some secure channel.
2. The sender uses the key to encrypt the plaintext into ciphertext.
3. The ciphertext is transmitted over the network.
4. The receiver uses the same key to decrypt the ciphertext back into plaintext.
5. Anyone intercepting the ciphertext without the key sees only scrambled bytes.

The key-sharing problem

Symmetric encryption is fast and simple, but it has one serious weakness: how do you get the secret key to the other person in the first place?

You cannot send the key over the same network you want to protect, because the insecure link would expose the key just as it exposes the data. Possible ways to share a symmetric key:

• Meet in person and read it out loud or hand over a piece of paper.
• Send it by post in a sealed envelope.
• Phone the other person and read the key digit by digit.
• Use an algorithm (such as Diffie-Hellman key exchange) that lets both ends derive the same key without sending it explicitly.
• Use asymmetric encryption to send the symmetric key the first time (the basis of HTTPS).

If an attacker ever gets a copy of the shared key, every past and future message can be decrypted.

When symmetric encryption is used

• Wi-Fi (WPA2 uses a symmetric key derived from the SSID and password)
• Encrypted file storage on disk
• The bulk of every HTTPS connection (after the initial key exchange)
• VPN tunnels between two known parties

4. Asymmetric encryption

Asymmetric encryption uses two related keys: a public key that anyone is allowed to know, and a private key that only the owner knows. Data encrypted with one of the keys can only be decrypted with the other.

How it works

Suppose Alice wants to send a private message to Bob.

1. Bob publishes his public key somewhere everybody can see it (e.g. on his website or in a public directory).
2. Bob keeps his private key secret, stored only on his own computer.
3. Alice fetches Bob's public key and uses it to encrypt her plaintext message into ciphertext.
4. Alice sends the ciphertext to Bob over the (insecure) network.
5. Bob uses his private key to decrypt the ciphertext back into Alice's original plaintext.
6. An attacker who has intercepted the ciphertext AND Bob's public key still cannot read the message, because only the private key can decrypt and the private key never leaves Bob's machine.

Why the public key cannot decrypt

The clever maths behind asymmetric encryption (RSA, ECC, etc.) is built so that knowing the public key is enough to encrypt but not enough to decrypt. Decryption requires the private key, which is held only by the recipient. Even though anyone can see the public key, no one can use it to reverse the encryption.

The big advantage: no shared secret to exchange

Asymmetric encryption solves the key-sharing problem. Bob can publish his public key to the whole world. Anyone (Alice, Charlie, total strangers) can use it to send him encrypted messages, and only Bob, with his private key, can read them. There is no need to pre-arrange a shared key.

The cost

Asymmetric encryption is much slower than symmetric encryption because the mathematics is more demanding. For this reason, real systems usually:

1. Use asymmetric encryption to exchange a small piece of data, such as a one-time symmetric key.
2. Then switch to symmetric encryption for the actual conversation, using the freshly exchanged key.

This is exactly what HTTPS does: a brief asymmetric handshake, then fast symmetric encryption for the bulk of the page load.

Key sizes

Modern asymmetric keys are large to resist guessing. A 100-bit key would give about 10³⁰ different possible values; a 2048-bit RSA key is the modern minimum. The number of possible combinations is so huge that a brute-force search is impossible with today's computers.

When asymmetric encryption is used

• HTTPS (the secure web), specifically the TLS handshake at the start of each connection
• Digital signatures that prove a message came from a particular person
• PGP / GPG email encryption
• SSH for secure remote login
• Certificate authorities verifying website identities

5. The Caesar cipher

The Caesar cipher is one of the oldest encryption methods, named after Julius Caesar who reportedly used it for military messages. It is far too weak to use today, but it is a useful teaching example of how a symmetric cipher works.

The rule

Each letter in the plaintext is replaced by the letter N positions further along the alphabet, where N is the agreed shift (the key). When the shift goes past Z, it wraps around back to A.

The shift N is the key. Both sender and receiver must agree on it before any messages are sent. Because the same key is used to encrypt and decrypt, the Caesar cipher is a symmetric cipher.

Decryption: shift in the opposite direction

To decrypt a Caesar cipher with shift +N, shift each letter backwards by N positions, wrapping from A back to Z when needed.

Why the Caesar cipher is broken

The Caesar cipher is hopelessly insecure by modern standards:

• Only 25 distinct keys. A shift of 0 leaves the message unchanged; shifts 1 through 25 are the only meaningful encryptions. An attacker can try every shift by hand in a couple of minutes (a "brute-force" attack).
• Letter frequencies leak the shift. In English, E is by far the most common letter, followed by T, A, O, I, N. If you take a piece of Caesar-encrypted text and find that one letter appears far more often than others, that letter is almost certainly the shifted version of E. Two minutes of frequency analysis cracks any Caesar cipher.
• No protection against pattern recognition. Repeated letters in the plaintext (like the "SS" in PASS) become repeated letters in the ciphertext, which gives away word structure.

The Caesar cipher is only used as a teaching example, not for real-world security. Modern symmetric ciphers like AES use 128-bit or 256-bit keys, giving roughly 10³⁸ to 10⁷⁷ possible combinations, far beyond what any attacker can search.