Privacy is often misunderstood as synonymous with or even identical to secrecy. However, it is important to distinguish the two. Secrecy unifies the two secret sharing party to become one as friends. It requires a secure channel, or a secret channel, between friends to exchange the key safely. Privacy, on the other hand, is much more individualistic. It does not require the two information sharing party to be unified under one group. Moreover, there is should be no need to establish a secure channel in advance for the information exchange either. In other words, security concern for privacy revolves around the problem of secure communications over insecure channel.
The need for privacy arose in conjunction with the development of communication technology. After the war, radio, telephone and computer technology made it much easier for people to send, receive, and store information. These technological liberation increased the freedom of people to have access to information. Unfortunately, open and wide access meant greater opportunity for adversary to eavesdrop, steal, or intercept other people’s information. Incidentally, there were raising concern over how Russia can monitor tens of thousands of American telephone conversation. These concerns raised the public need to protect the privacy of their information.
In order to satisfy the public need, NSA, the government body that was in charge of policy regarding cryptography, published cypher system known as Data Encryption Standard(DES) for the public use. However, it could not soothe the public need.There were two major reasons why DES was not sufficient for the public need:
- Political reasons: Before the standard was released for the public use, there were a series of debate whether cryptography should be allowed to the public. On the one hand, it was obvious that the booming technology required the public to protect the privacy. On the other hand, public use of cryptography could jeopardize the government’s ability for criminal investigation. For national security purpose, cryptography was considered as munition. Along with these concerns, there are allegations that NSA inserted backdoor to the published algorithm. Moreover, many mathematicians and cryptographers pointed out the obvious shortness of the key length of DES. Nevertheless, in the midst of all the shenanigans, DES was released in 1977. Shortly afterwards, personal computation greatly increased individual ability to break the cipher codes.
- Technical reasons: DES was a based on symmetric key cryptographic technology. The biggest problem of symmetric key cryptography in general is key distribution method. In order for two parties to share the same key, there must be a established private channel where they can exchange the keys. Perhaps this can be achieved if one party, say government, establish the private channel of all individual. This way would need an operator, like telephone operator and modem operator during the early days of each technology. However, it would be very far from direct communication between individual. For direct communication, symmetric cryptography was simply impossible.
Development in communication technology promised greater accessibility for people. Now, people were given freedom to converse with one another. However, the security technology was not on par with the ability for freedom. Symmetric cryptography still required the centralized authority, the government, to monitor and control the system. On the other hand, people demanded their privacy; it was the time for the new cryptography.
In 1976, Martin Hellman and Whitfield Diffie suggested new directions in cryptography. It was called the public key cryptography. There were three main features how public key cryptography was different from the conventional technology.
- Open publication of algorithm: After Diffie and Hellman published their work, there were surges of movement that published the new technology to the public. For instance, shortly after the publication, Ron Rivest, Adi Shamir, and Leonard Adleman published a practical implementation of the public key cryptography. It was generic description of algorithm. Later, they filed patent with their algorithm and opened business. Then invented chips for secure phone conversation and produced software that could generate keys. It is not hard to imagine that NSA was weary of Renaissance of cryptography. Controversy and argument continued on whether people should be in control of cryptography. However, it seems that the new era was inevitable. Cryptology went public.
- Individual Key: The idea of public key cryptography is rather simple. Individuals are each given two keys: public key and private key. When A would like to send message M to B, A would encrypt M with B’s public key. B would receive the message and decrypt M using its private key. Then, B safely receives the message. From its design, it is computationally infeasible to trace private key from the public key. The message exchange is safe. The consequence of this simple structure is rather surprising. In this case, A and B may be a total stranger. Without the need to establish a common secret key in advance, like in the symmetric key cryptography system, A and B are able to safely exchange message as long as they hold on to their individual key. That is to say, if A and B use the same algorithm that is open to public, they are no longer in need to rely on a separate entity to ensure the security.
- Authentication: Of course, there is another stranger-danger concern. If A and B are really strangers to one another, it would be difficult for A to be assured that the receiver is in fact B. Public key cryptography has second part to its story that solve this problem from its design. Coming back to the conversation between A and B, when A would like to authenticate B’s identity, it may request its digital signature. Digital signature is mixed message between the original message M and its private key. B would send its digital signature generated from M and B, which A would authenticate that it was from B by decrypting M using B’s public key. Of course, digital signature should be algorithmically secure so that it should be impossible to guess B’s private key from its digital signature.
The combination of three characteristics enabled public key cryptograph to be the solution for the problem of direct communication between individuals. Now, as long as individuals are steadfast to their own key, they no longer need to rely on authority to ensure the security of their conversation. People are free to protect their privacy privately. However, data privacy was not considered as important as it was first supposed it to be. For instance, RSA chip designed for secure phone conversation made almost no public impact. It was not until personal computer was invented and the age of internet came around that public key cryptography found its real use-case.
