e software the sender used to scramble it. For example, the sender could create a self-decrypting archive that prompts the recipient for a password when double-clicked. Or the sender could create files that could be dragged into a Web browser and unscrambled with a web-based decryption script like ShyFile. Not all programs support self-decrypting archives.
To summarize: the simplicity of symmetric key encryption makes it easy to understand, but distribution of the key is risky.
Some software programs use the asymmetric key, or "public key/private key" model, which requires both the sender and the recipient to have the same software. With this model, the recipient makes a pair of keys, both of which can be unlocked with a single password. One half of the pair is a public key that anyone with the same software uses to encrypt a message to the recipient. The sender does not need the recipient's password to use his or her public key to encrypt data. The recipient's other key is a private key that only he or she can use when decrypting the message. The private key should never be distributed since the private key assures that only the intended recipient can unscramble data intended for him or her. The recipient can freely distribute the public key without worrying since it is only used to scramble the data.
You must meet two conditions before you can use asymmetric encryption software: 1) the recipient must have the same software and already have created a key pair, and 2) you must have the recipient's public key. There are many ways to distribute a public key: through text in an email, through text in a file on a floppy disk, or by posting it on special Internet sites known as key servers. For example, if the recipient's public key is available on a PGP server, your PGP software program can retrieve and store the key on your computer for use at any time.
Here is an example of how asymmetric encryption works: If Jack has Jill's public key, Jack can send encrypted files that Jill can unlock with her private key. Jack can't use Jill's public key to decrypt files intended for Jill (since decrypting a file intended for Jill requires Jill's private key), nor can he sign files pretending to be Jill. Even if Jack got his hands on Jill's private key file, he would need Jill's password to access it.
The biggest problem with this method of encryption is verifying that the sender is who he or she claims to be. The solution is called a "Web of Trust", which makes use of digital signatures. If Jill wants to verify that the Jack who sent her an encrypted file is really the Jack she knows, she confirms his identity by some non-electronic method, such as a personal meeting or phone call, or by an electronic method such as the AT&T Pathserver. If Jack has previously taken similar steps to confirm the identity of John Doe, Jill can also trust an encrypted file from John.
See an illustrated model of encrypting and signing data. These pages are part of the Asia Pacific Network Information Centre's Certificate Authority Status Report.
Some software programs are more useful for encrypting files, and others are more useful for encrypting text messages, like email and instant messages. It's possible to use a file-encryption program for both files and email. Some file-encryption programs, for example, encrypt email by transforming the message into a file, and then sending the encrypted file. However, some of the software specifically designed for email encryption is much easier to use than programs for file encryption. Other email encryption software programs convert plaintext to ciphertext, which is useful for encrypting email or text documents, but useless for encrypting images or other non-text files. Other encryption software simply enables you to store encrypted files on your computer.
In addition to the different encryption algorithms and models, there are different software interfaces. Some programs require you to locate the file you want to encrypt through a regular "file-open" dialogue window. Others, including PGP, allow you to encrypt a hi