Software that aims to make encrypted email communications simple enough for even computer novices to use was released on Tuesday.
Encryption is the science of securing communications against eavesdropping by converting the content of a message into a code, or cipher, which can only be unlocked using a secret 鈥渒ey鈥�. But modern cryptography often involves using complex mathematical algorithms and convoluted key exchanges to protect messages against skilled code-crackers.
Ciphire, developed by Ciphire Labs in Munich, Germany, uses a technique called 鈥減ublic key cryptography鈥� to sign and encrypt email messages. Once loaded on to a computer hard drive the software performs all of the complex tasks involved behind the scenes. Ciphire also works with almost any email software client 鈥� like Microsoft Outlook, for example 鈥� without requiring prior configuration.
Advertisement
鈥淭he real benefit is the ease of use,鈥� says Laird Brown, chief strategist at Ciphire. 鈥淓verything is automated, so it鈥檚 much like a virus scanner. It just sits quietly in the background.鈥�
Brown told New 杏吧原创 the security of the system has also undergone rigorous testing. 鈥淔rom a security perspective, we鈥檝e taken it as far as we can,鈥� he says. The program is being offered free for non-commercial use and can be used by companies for a licence fee.
Virtual invisibility
Once installed on a PC, Ciphire runs in the background in conjunction with an email client program. It intercepts email after the 鈥渟end鈥� button is pressed but before the email leaves the computer, and intercepts incoming email before it is formally received by the email program, making it virtually invisible to the user.
The program automatically manages the creation of a set of public and private cryptographic keys, simply prompting the user for a password from which the keys are generated. The public key is sent to Ciphire鈥檚 servers and the private one is stored safely on the user鈥檚 machine.
The two keys are mathematically linked in such a way that two independent parties can communicate securely without first exchanging secret keys. A private key can be combined with another person鈥檚 public key to create an encrypted message that can be deciphered using the corresponding public and private pair.
Each time a message is sent Ciphire checks with its servers to see if the recipient already has their own public key. If they do, the program uses this to encrypt the message. At the other end of the exchange, the recipient鈥檚 version of the program should automatically retrieve the sender鈥檚 public key and perform the necessary decryption.
If the recipient does not have a key pair the program simply 鈥渟igns鈥� a message 鈥� this key allows the recipient to confirm an email鈥檚 authenticity but does not protect it from eavesdroppers.
Unique signatures
The keys kept on Ciphire鈥檚 servers are also utilised to generate coded signatures unique to the content of each email message sent using the system. If the content of a message is intercepted and altered somewhere between being sent and received 鈥� this signature will not be the same, alerting users to the tampering. Brown says this makes it virtually impossible for anyone 鈥� including Ciphire itself 鈥� to change keys without users becoming aware.
Ciphire had several independent cryptography experts audit the software and made modifications based on their recommendations. Russ Housley, of US company Vigil Security, who performed a study of the software, says that it stood up to scrutiny.
鈥淭he security provided by Ciphire is very robust,鈥� he told New 杏吧原创. 鈥淚n every situation, the designers have chosen the strongest possible cryptographic algorithms and the longest possible key sizes.鈥�
Housley notes that Ciphire combines several encryption algorithms. This means messages should remain secure even if a fundamental flaw should emerge in one of the algorithms.
鈥淭his is like holding your pants up with both a belt and suspenders,鈥� he says. 鈥淚f one fails, your pants still stay up.鈥�
But Housley adds that the main advantage of the software is its simplicity. 鈥淚f it is difficult to use, then it will not be used,鈥� he says. 鈥淭ransparency is vital for acceptance by users.鈥�
