ted with the programs and to use them on a day-to-day basis. Since cost is also a major concern for non-profits, we have included reviews of several low-cost or free software options.
All encryption software programs choose an algorithm that they rely on to scramble and unscramble your data. Some programs use more obscure, proprietary algorithms, but others use widely available algorithms. The benefit of using an obscure algorithm is there is less likelihood that tools for cracking it are available. The benefit of using a well-known algorithm is that it has been thoroughly tested. If a vulnerability has not yet been discovered, finding one is probably very difficult.
(For more in-depth information on the various available algorithms, see Appendix B: What are the different kinds of algorithms that encryption software programs utilize?)
Software uses algorithms to encrypt your data in two ways: the symmetric key method, and the asymmetric key method. With either method, it is important to save a copy of your key on a floppy of zip disk, a CD, or another hard drive. Otherwise, if you lose or forget your key, or the key data gets corrupted, you will not be able to decrypt your encrypted data.
Many encryption programs scramble and unscramble with the same key. This simple scheme allows anyone possessing the key that encrypted the data to also decrypt the data. It is important, in order to maintain security, that the sender distribute the key to the intended recipient without letting it fall into the wrong hands. If the sender emails the key in a regular, unscrambled message, malicious parties could easily intercept it in transit. If the sender encrypts the key before emailing it, the recipient will need a second key to decrypt the first key. If the sender copies the key onto a floppy or zip disk, or CD, the disk could be lost in transit or misplaced by the recipient.
Only software programs utilizing this basic model, symmetric key encryption, allow the recipient to unscramble an encrypted message without using the same software the sender used to scramble it. For example, the sender could create a self-decrypting archive that prompts the recipient for a password when double-clicked. Or the sender could create files that could be dragged into a Web browser and unscrambled with a web-based decryption script like ShyFile. Not all programs support self-decrypting archives.
To summarize: the simplicity of symmetric key encryption makes it easy to understand, but distribution of the key is risky.
Some software programs use the asymmetric key, or "public key/private key" model, which requires both the sender and the recipient to have the same software. With this model, the recipient makes a pair of keys, both of which can be unlocked with a single password. One half of the pair is a public key that anyone with the same software uses to encrypt a message to the recipient. The sender does not need the recipient's password to use his or her public key to encrypt data. The recipient's other key is a private key that only he or she can use when decrypting the message. The private key should never be distributed since the private key assures that only the intended recipient can unscramble data intended for him or her. The recipient can freely distribute the public key without worrying since it is only used to scramble the data.
You must meet two conditions before you can use asymmetric encryption software: 1) the recipient must have the same software and already have created a key pair, and 2) you must have the recipient's public key. There are many ways to distribute a public key: through text in an email, through text in a file on a floppy disk, or by posting it on special Internet sites known as key servers. For example, if the recipient's public key is available on a PGP server, your PGP software program can retrieve and store the key on your computer for use at any time.
Here is an example of how asymmetric encryption works: If Jack has Jill's public key, Jack can send encrypted files that Jill can unlock with her private key. Jack c