There is a form of cryptography, the one-time pad, which is unbreakable when used correctly. One-time pad requires keys to be equal in size to the sum of all data to be transferred. And they need to be transported in advance. This makes them suitable for nuclear weapon launch codes but infeasible for e-Commerce.
Current cryptographic schemes used in e-Commerce provide computational security as opposed to theoretically perfect security, i.e. with a certain amount of effort an encryption system can be broken. This can be considered to be essentially equivalent to the levels of protection applied to conventional documents. A standard business letter on single color letterhead is relatively easy to forge, whereas a share certificate on special paper with a company seal attached is more difficult to replicate, but costs more to produce. Similar security options apply to E-Commerce. However, increased security comes at a price. Increasing key size, which requires more processing power and larger computers, is the main way to increase the level of security.
Because public key ciphers use much more computing power than symmetric ciphers, most e-Commerce applications rely on a mixture of both types. When a secure communication session starts, both parties use public key cryptography to encrypt 'session keys' and then send them to one another. Once the session keys have been exchanged, then both parties switch to symmetric cryptography for the remainder of the communications session, using the session keys just exchanged. Each cryptography scheme, therefore, must choose both a symmetric and a public key cipher.
The basic cryptographic mechanisms used by e-Commerce applications are very strong relative to the algorithms that were used up to very recent times. It is widely believed that, the 1024-bit RSA with triple DES provides more than adequate security such that even the intelligence agencies of superpower nations would find it hard to break. It is safe to assume that major breakthroughs in computer design or math would be needed to break such a level of cryptography and would cost a potential attacker tens of millions of dollars.
|
