Data Encryption

Data that travels across unsecured networks is vulnerable to anyone who wants to read, alter, or forge information. Using easily obtained tools such as protocol analyzers, just about anybody can read packets and gain access to classified information. Hostile parties can tamper with packets, hinder delivery, or prevent network communications.

Encryption provides a means to scramble and protect information as it travels across an otherwise unsecured network. Different levels of encryption can keep anyone from deciphering the message or figuring out the message’s origin and destination.

Almost all methods of encryption rely on two basic items, codes and keys.

First, you must develop a mathematical code so that only those processing the right keys to the equation can properly code and decode messages. Extremely complicated mathematic functions are used in the following way. The mathematics are so complex that without knowing both the encryption code and the right key, it is virtually impossible to figure out the original message.

The second key piece of encryption is the distribution and protection of keys. There are a number of methods for key exchanges; the following At-A- Glance sheet focuses on the Diffie-Hellman method.

Bullets, Bombs, and Secret Codes
It might surprise you at first: Encryption codes and cryptography methods have the same export laws as guns, ammunitions, and explosives!

However, it does start to make sense when you think about the damage that could come from someone unraveling the myriad encrypted messages sent across the Internet every minute of every day. Access to this information could compromise military operations or expose the information that businesses and organizations keep secret.

What might happen if one company knew every other company’s marketing plans, or if your insurance company could track all your credit-card purchases? In dollars and cents, the damage could be as bad or worse than what a bomb could do.

Where You Encrypt Matters
You can implement encryption at one of three OSI layers: the application, the data link, or the network. Each layer has advantages and disadvantages.

For application layer encryption, you must upgrade each application to support encryption, and all hosts that communicate with the applications must speak the same encryption language. This setup can often mean replacing all the hosts in a network, but it does not necessarily require any network upgrades because traffic is unaffected.

You can do network layer encryption anywhere in the network (at the ingress and egress, for example). You do not have to upgrade the hosts. It also leaves pertinent Layer 3 and Layer 4 information in the clear for use in routing. Network layer encryption has a good balance of security and cost.

Data link layer encryption is very secure because it encrypts everything (including IP addresses). The downside is that each router must decrypt the traffic at every link and then re-encrypt it once the correct path is determined. This process is very slow.