Encryption for users. Part one.

    One of my customers somehow needed a way to organize secure communication between several people. For communication, it was supposed to use instant messaging systems (ICQ). As far as I know - for telephone calls they bought some nozzles that encrypted a voice signal. I didn’t see them live, and therefore I can’t say how effective they are. But I want to talk about encryption of electronic messages in detail. Fortunately, I took care of them.


    I'm still an amateur in encryption. I don’t have a set of tools for checking encrypted messages for cryptographic strength, it is very difficult for me to evaluate encryption algorithms due to the lack of such experience and in general I am only decrypting at the level of base64 and md5 algorithms. Therefore, I can only offer what I heard from other people. In this case, I proposed two options, describing their main pros and cons.

    The first applicant for an electronic information provider was Skype.


    The main reasons for using it are a commercial product with its technical support. In addition to text messages and files, he can transmit video and voice, which is undoubtedly attractive to the average user. At the same time, a beautiful interface also plays into their hands. Theoretically, it can also be used to hide your location by connecting call services from Skype to city numbers and from city numbers to Skype. It looks pretty attractive.

    But skype also has disadvantages. The main one is closed commercial development. Few people know what's going on inside him. This is by no means conducive to security. So, compared to the second candidate for the role of a secure data provider, which will be a bit lower, Skype is younger. I, like my customer, consider it approximately the same - in such a case as security, the old rather than the young algorithm is better, provided that none of them have yet learned to hack.

    The second applicant is the good old cryptographer pgp and its free counterpart gnupg.


    He also has many advantages. Starting with the fact that these are open algorithms - and, accordingly, their reliability, given their age, is potentially higher than that of Skype. At the same time, they are supported by a fairly large number of software. The ability to encrypt using pgp / gpg is built into some of them initially, while others are integrated by plugins. The width of the scope follows from this - with its help you can not only transfer data, but also encrypt files and entire disks.

    Of the minuses, one can answer the lack of free software that can beautifully manage all this economy. And the one that is far inferior in terms of usability to the first applicant. Despite the support from many applications, everyone does it differently so you have to get used to each new tool.

    As a result, gnupg was chosen.


    The advantage in the reliability of the algorithms played a role. But, I think, if encryption had to be used in a company of 12 people, and not in a company of three people, Skype would have won because of the ease of implementation.

    I will not talk about software that can use encryption in my work for a long time - I can say that I tried it myself. And I myself did not try as much as I would like.

    The worst situation is with graphical key management utilities. Most of all I liked the thunderbird plugin - enigmail . Despite the problems with the language - in a couple of places, an encoding error constantly pops up, he has Russification, is cute and quite intuitive. I compared it with the two utilities that are part of gpg4win. In particular, the latter do not know how to import or export a public key to the clipboard, which is often convenient when exchanging public keys, and the procedure for installing the Russian language is somewhat nontrivial for a simple user.

    I believe that encryption should become widespread. This saves you from a lot of things - from hacking to normal listening. In my opinion, if message encryption is gaining popularity, it will only benefit the public if, of course, it is possible to overcome the resistance of states and relevant services.


    Original

    Also popular now: