Security
The steps involved in keeping your information safe!
Most security protocols that work over the Internet use encryption to keep your information safe. Encryption is the process of encoding information in such a way that only the person (or machine) with the correct key can decode it.
This page will show you what to look out for, so you know whether or not the page your on is using a secure connection. This page will also provide information on the various stages involved when secure connections are established between your computer and our web server.
What do I look out for?
The most widely adopted implementation of public-key encryption today, is Secure Socket Layer (SSL). SSL is used by internet browsers and web servers to transmit sensitive information. SSL has become part of an overall security protocol known as Transport Layer Security (TLS).
In your browser, you can easily tell when or not you are using a secure protocol, such as TLS, in a couple of different ways. You will notice that the "http" in the address line is replaced with "https" and you should see a small padlock in the status bar at the bottom of the browser window. When you're processing sensitive information, such as viewing your online bank account or entering your credit card information, such as the the final step in the check-out process for this site! You'll will see these indicators and know your information is being processed securely through an encrypted connection.
What actually happens when my information is encrypted?
To implement public-key encryption en masse digital certificates are used. A digital certificate is basically a unique identifier that says the web server is trusted by an independent source known as a certificate authority. The certificate authority acts as an intermediate that both computers trust. It verifies that each computer is who it says it is. It then provides the public keys of each computer to the other.
Your browser then uses the public key to encrypt a randomly selected symmetric key. It dose this because public-key encryption requires a lot of processing power, so most systems use a combination of public-key and symmetric key encryption. When two computers initiate a secure session, one computer creates a symmetric key and sends it to the other computer using public-key encryption. The two computers can then communicate using symmetric-key encryption. Each computer discards the symmetric key used for that session when it is no longer needed. Any additional sessions require that a new symmetric key be created, and the process is repeated.
How dose encryption work?
Public-key encryption uses two different keys at once. A combination of a private key and a public key. So your browser will use the public key our server sends, to encrypt your information. This information cannot be read by anyone. The only way to decrypt this information is to use both the private key and public key. The private key is never sent by the server so their is never any way for anyone who intercepts your information and read it.
The key pair is based on long prime numbers. This makes the system extremely secure, because there is essentially an infinite number of prime numbers available, meaning there are nearly infinite possibilities for keys.
The keys in public-key encryption is based on a hash value. This is a value that is computed from a base input number using a hashing algorithm. Essentially, the hash value is a summary of the original value. The important thing about a hash value is that it is irreversible you can't derive the original input number without knowing the data used to create the hash value. Here's a simple example:
You can see how hard it would be to determine that the value 1,525,381 came from the multiplication of 10,667 and 143. But if you knew that the multiplier was 143, then it would be very easy to calculate the value 10,667. Public-key encryption is actually much more complex than this example, but that's the basic idea.
Public keys generally use complex algorithms and very large hash values for encrypting, including 40-bit or even 128-bit numbers. A 128-bit number has 3,402,823,669,209,384,634,633,746,074,300,000,000,000,000,000,000,000,000,000,000,000,000 different combinations..! This would be like trying to find one particular grain of sand in the Sahara Desert.
Essentially if someone were to intercept an encrypted transaction and had the public key. They would then need to try and find the private key before they could decrypt the data. Since the keys are stored as hashed values their is no mathematical way for them so simply 'crack' or obtain the private key from the public key. Meaning they would have to try and match one by one any these possible combinations. Even if they had all the computing power in the world dedicate to this single task. It would take hundreds of years before a match might be found. By that time the information will not be relevant any more.
Most security protocols that work over the Internet use encryption to keep your information safe. Encryption is the process of encoding information in such a way that only the person (or machine) with the correct key can decode it.
This page will show you what to look out for, so you know whether or not the page your on is using a secure connection. This page will also provide information on the various stages involved when secure connections are established between your computer and our web server.
What do I look out for?
The most widely adopted implementation of public-key encryption today, is Secure Socket Layer (SSL). SSL is used by internet browsers and web servers to transmit sensitive information. SSL has become part of an overall security protocol known as Transport Layer Security (TLS).
In your browser, you can easily tell when or not you are using a secure protocol, such as TLS, in a couple of different ways. You will notice that the "http" in the address line is replaced with "https" and you should see a small padlock in the status bar at the bottom of the browser window. When you're processing sensitive information, such as viewing your online bank account or entering your credit card information, such as the the final step in the check-out process for this site! You'll will see these indicators and know your information is being processed securely through an encrypted connection.
What actually happens when my information is encrypted?
To implement public-key encryption en masse digital certificates are used. A digital certificate is basically a unique identifier that says the web server is trusted by an independent source known as a certificate authority. The certificate authority acts as an intermediate that both computers trust. It verifies that each computer is who it says it is. It then provides the public keys of each computer to the other.
Your browser then uses the public key to encrypt a randomly selected symmetric key. It dose this because public-key encryption requires a lot of processing power, so most systems use a combination of public-key and symmetric key encryption. When two computers initiate a secure session, one computer creates a symmetric key and sends it to the other computer using public-key encryption. The two computers can then communicate using symmetric-key encryption. Each computer discards the symmetric key used for that session when it is no longer needed. Any additional sessions require that a new symmetric key be created, and the process is repeated.
How dose encryption work?
Public-key encryption uses two different keys at once. A combination of a private key and a public key. So your browser will use the public key our server sends, to encrypt your information. This information cannot be read by anyone. The only way to decrypt this information is to use both the private key and public key. The private key is never sent by the server so their is never any way for anyone who intercepts your information and read it.
The key pair is based on long prime numbers. This makes the system extremely secure, because there is essentially an infinite number of prime numbers available, meaning there are nearly infinite possibilities for keys.
The keys in public-key encryption is based on a hash value. This is a value that is computed from a base input number using a hashing algorithm. Essentially, the hash value is a summary of the original value. The important thing about a hash value is that it is irreversible you can't derive the original input number without knowing the data used to create the hash value. Here's a simple example:
| Input number | Hashing algorithm | Hash value |
| 10,667 | Input # x 143 | 1,525,381 |
You can see how hard it would be to determine that the value 1,525,381 came from the multiplication of 10,667 and 143. But if you knew that the multiplier was 143, then it would be very easy to calculate the value 10,667. Public-key encryption is actually much more complex than this example, but that's the basic idea.
Public keys generally use complex algorithms and very large hash values for encrypting, including 40-bit or even 128-bit numbers. A 128-bit number has 3,402,823,669,209,384,634,633,746,074,300,000,000,000,000,000,000,000,000,000,000,000,000 different combinations..! This would be like trying to find one particular grain of sand in the Sahara Desert.
Essentially if someone were to intercept an encrypted transaction and had the public key. They would then need to try and find the private key before they could decrypt the data. Since the keys are stored as hashed values their is no mathematical way for them so simply 'crack' or obtain the private key from the public key. Meaning they would have to try and match one by one any these possible combinations. Even if they had all the computing power in the world dedicate to this single task. It would take hundreds of years before a match might be found. By that time the information will not be relevant any more.