Encrypting transmitted data

Encrypting transmitted data means scrambling information before it travels across a network so it cannot be read on the way. The sending software turns readable plaintext into ciphertext using an encryption algorithm and a key, and the receiving device needs the matching decryption key to decrypt it back into plaintext. Only the ciphertext travels, so anyone who copies it holds something unreadable.

Encryption does not stop data being copied or intercepted, and it is not the same as password-protecting a file. What it does is remove the value of a copy. A passive attack such as packet capture silently copies packets as they pass along the network without changing or stopping them, and in a man-in-the-middle attack an attacker places themselves between the two devices, passing messages on while reading them. Without the decryption key, captured ciphertext is unreadable, so the contents are not revealed.

Worked example

A student buys a concert ticket from a venue's website and types in their card number. Their browser encrypts the details before sending them, so the venue's server receives ciphertext and decrypts it with its key. Someone copying the packets on the café Wi-Fi would see only scrambled characters, not the card number.

Web traffic and checking identity

Data sent over the web can be encrypted using SSL, commonly set up through HTTPS, which creates an encrypted connection between the browser and the web server. During that set-up the server has to show that it is genuine: it presents a digital certificate containing a digital signature, which the browser checks against a trusted authority, so an impostor site cannot take its place. The same exchange lets the two ends agree a key for the encrypted connection.

VPNs

A VPN (virtual private network) encrypts the data a device sends over a network, which is useful on a network you do not trust, such as public Wi-Fi on a school trip, because the traffic cannot be read in transit.