AS & A Level Information Technology Chapter 1: Data Processing and Information

appointment at quarter past two? Does she mean today, tomorrow or next week? The
information in incomplete.
• You want to plan the family picnic for tomorrow. However, when you check the
weather forecast you are only told what the weather in the morning will be like. There
is nothing about the afternoon. You can't really make a decision just based upon what
the morning weather is likely to be.

Encryption
The need for encryption
When data is transmitted over any public network (wired or wireless), there is always a risk
of it being intercepted by, for example, a hacker. Using encryption helps to minimize this
risk.
Once it is intercepted the information can be changed or used for purposes such as
identity theft, cyber-fraud. If, however, the information is intercepted but it is unreadable
or cannot be understood, it becomes useless to the hacker or interceptor.
Encryption is a way of scrambling data so that only authorized people can understand the
information. It is the process of converting information into a code which is impossible to
understand. This process is used whether the data is being transmitted across the internet
or is just being stored. It does not prevent cyber criminals intercepting sensitive
information, but it does prevent them from understanding it. This is particularly important
if the data is sensitive or confidential for example, credit card/bank details, medical history
or legal documents.

Methods of encryption
Encryption is the name given to converting data into a code by scrambling it, with the
resulting symbols appearing to be all jumbled up. The algorithms which are used to
convert the data are so complex that even the most dedicated hacker would be extremely
unlikely to discover the meaning of the data.
Encrypted data is often called ciphertext, whereas data before it is encrypted is called
plaintext.

The way that encryption works is that the computer sending the message uses an
encryption key to encode the data. The receiving computer has a corresponding
decryption key that can translate it back again.
AS & A Level Information Technology Chapter 1: Data Processing and Information

A key is just a collection of bits, often randomly generated by a computer. The greater the
length of the key, the more effective the encryption.
Modern encryption uses 256- bit keys which makes this form of encryption virtually
impossible to crack. The key is used in conjunction with an algorithm to create the
ciphertext.
There are two main types of encryption. One is called Symmetric Encryption and the other
is Asymmetric Encryption, which is also referred to as public-key encryption.

Symmetric encryption
Symmetric encryption is a type of encryption that uses the same key to encrypt and
decrypt data. Both the sender and the recipient have identical copies of the key, which
they keep secret and don’t share with anyone. This differs from asymmetric encryption,
which uses two keys, a public key (that anyone can access) to encrypt information and a
private key to decrypt information.
How symmetric encryption works
• The sender uses an encryption key (usually a string of letters and numbers) to encrypt
their message.
• The encrypted message, called ciphertext, looks like scrambled letters and can’t be
read by anyone along the way.
• The recipient uses a decryption key to transform the ciphertext back into readable
text.

In the example above, we used the same key for encryption and decryption, which means
this is symmetric encryption.
Only these two parties (sender and recipient) can read and access the data. This is why it’s
also sometimes called secret key encryption, secret key cryptography, private key
cryptography, symmetric cryptography and symmetric key encryption.
AS & A Level Information Technology Chapter 1: Data Processing and Information

Asymmetric encryption
Asymmetric encryption is also known as public-key cryptography. Asymmetric encryption
overcomes the problem of symmetric encryption keys being intercepted by using a pair of
keys. This will include a public key which is available to anybody wanting to send data, and
a private key that is known only to the recipient. The key is the algorithm required to
encrypt and decrypt the data.
Using an example to explain how this works; suppose Tom and Jane work for the same
company and Tom wishes to send a confidential document to Jane:
1. Jane uses an algorithm to generate a matching pair of keys (private and public) that
they must keep stored on their computers; the matching pairs of keys are
mathematically linked but can’t be derived from each other.

2. Jane now sends her public key to Tom.

3. Tom now uses Jane’s public key to encrypt the document he wishes to send to her.
He then sends his encrypted document (ciphertext) back to Jane.

4. Jane uses her matching private key to unlock Tom’s document and decrypt it; this
works because the public key used to encrypt the document and the private key
used to decrypt it are a matching pair generated on Jane’s computer. (Jane can’t use
the public key to decrypt the message.)

Encryption protocols
An encryption protocol is the set of rules setting out how the algorithms should be used to
secure information. There are several encryption protocols.
IPsec (internet protocol security)
is one such protocol suite which allows the authentication of computers and encryption of
packets of data in order to provide secure encrypted communication between two
computers over an internet protocol (IP) network. It is often used in VPNs (virtual private
networks).
AS & A Level Information Technology Chapter 1: Data Processing and Information

SSH (secure shell)

is another encryption protocol used to enable remote logging on to a computer network,
securely. SSH is often used to login and perform operations on remote computers, but it
can also be used for transferring data from one computer to another.
Transport Layer Security (TLS) and Secure Socket Layer (SSL)
The most popular protocol used when accessing web pages securely is transport layer
security (TLS). TLS is an improved version of the secure sockets layer (SSL) protocol and has
now, more or less, taken over from it.
The three main purposes of SSL/TLS are to:
• Enable encryption in order to protect data
• Make sure that the people/companies exchanging data are who they say they are
(authentication)
• Ensure the integrity of the data to make sure it has not been corrupted or altered.
Many websites use SSL/TLS when encrypting data while it is being sent to and from them.
This keeps attackers from accessing that data while it is being transferred. SSL/TLS should
be used when storing or sending sensitive data over the internet. The SSL/TLS protocol
enables the creation of a secure connection between a web server and a browser. Data
that is being transferred to the web server is protected from eavesdroppers.

Uses of encryption
There are many reasons to encrypt data:
• Companies often store confidential data about their employees, which could include
medical records, payroll data, as well as personal data.
• An employee in a shared office may not want others to have access to their work
which may be stored on a hard disk, so it needs to be encrypted.
• A company’s head office may wish to share sensitive business plans with other offices
using the internet. If the data is encrypted, they do not have to worry about what
would happen if it were intercepted.
• When individuals are emailing each other with information they would want to remain
confidential. They need to prevent anybody else from reading and understanding their
mail.
• People use websites for online shopping and online banking. When doing so, the
debit/credit card and other bank account details should be encrypted to prevent
fraudulent activity taking place.
AS & A Level Information Technology Chapter 1: Data Processing and Information

Applications of encryption
Hard disk encryption
Hard-drive encryption is a technology that encrypts the data stored on a hard drive using
sophisticated mathematical functions. Data on an encrypted hard drive cannot be read by
anyone who does not have access to the appropriate key or password. This can help
prevent access to data by unauthorized persons and provides a layer
of security against hackers and other online threats.
When a file is written to the disk, it is automatically encrypted by specialised software.
When a file is read from the disk, the software automatically decrypts it while leaving all
other data on the disk encrypted. The encryption and decryption processes are understood
by the most frequently used application software such as spreadsheets, databases and
word processors.
The whole disk is encrypted, including data files, the OS and any other software on the
disk. Full disk encryption is your protection should the disk be stolen, or just left
unattended. So, even if the disk is still in the original computer, or removed and put into
another computer, the disk remains encrypted and only the keyholder can make use of its
contents.
Email encryption
Email encryption involves encrypting, or disguising, the content of email messages in order
to protect potentially sensitive information from being read by anyone other than
intended recipients. Email encryption often includes authentication.
Email is a vulnerable medium, particularly when emails are sent over unsecured, or public,
Wi-Fi networks. Even emails sent within a secure company network can be intercepted by
other users, including your login credentials. Encryption renders the content of your emails
unreadable as they travel from origin to destination, so even if someone intercepts your
messages, they can’t interpret the content.
Email encryption: what to
encrypt?

1. The connection from your

email provider.
2. Your actual email
messages.
3. Your stored, cached, or
archived email messages.
AS & A Level Information Technology Chapter 1: Data Processing and Information

Encryption in HTTPS websites

Normal web pages that are not encrypted are fetched and transmitted using Hypertext
Transfer Protocol (HTTP). Anybody who intercepts web pages or data being sent over HTTP
would be able to read the contents of the web page or the data. This is particularly a
problem when sending sensitive data, such as credit card information or usernames and
password.
HTTPS, or Hypertext Transfer Protocol Secure, is the secure version of HTTP, which is the
only primary protocol browsers use to connect to web servers and display web pages to
users. HTTPS uses asymmetric encryption to secure the data in transport between the web
server and client.
HTTPS is more favorable where privacy is more relevant. These can be situations where we
are making online transactions, logging into our bank, or other tasks that would include the
usage of sensitive documents. A green padlock, or simply a padlock, is shown, which
signifies the usage of HTTPS.
HTTPS uses Secure Socket Layer (SSL) or Transport Layer Security (TLS) to encrypt and
decrypt pages and information sent and received by web users.
How HTTPS works

1. You start your web browser and request a secure page by using the https:// prefix on
the URL.
2. Your web browser contacts the web server on the HTTPS port and requests a secure
connection.
3. The server responds with a copy of its SSL certificate.
4. Your web browser uses the certificate to verify the identity of the remote server and
extract the remote server's public key.