Encryption is used frequently by
modern operating systems, both online and off. Anytime there is data such as passwords or
other sensitive information that needs to be stored or transferred between computers, encryption
is generally used to render it undecipherable to all but the intended recipients.
For
example, all modern versions of Windows store user passwords not in plain text
as they are entered, but in a numerical hash of the original, encrypted by one of several different methods. In this
way, nobody can gain this information simply by browsing files or the registry.
With the increasing use of the Internet as
a medium for carrying information, encryption has come into its own. If
you are transferring data across a public network, you want to at least make
sure that the data is sufficiently encoded as to make it unreadable to the
casual eavesdropper. The basic principal behind most computer data encryption methods is that each computer
participating in the transfer of encrypted data will have a numerical value (key)
which it will use to encode the data it sends over the wire into
a meaningless collection of characters.
Depending on the method of encryption used, this key
will either be agreed on with the remote computer before the data is sent, then
used by both computers to encrypt and decrypt the data, or one computer's
key will be used to encode data only for another computer's separate key value
to decode, and vice versa. There are many
methods of encryption currently in use, and we will look at the ones most
commonly used in Internet transactions.
SSL introduced (and a brief TCP/IP primer)
SSL, or Secure Socket Layer, is a method of securing standard Internet
transactions by using encryption. 128-bit SSL encryption is the standard for
secure communication across the Internet.
All communication on the Internet
is accomplished using the TCP/IP (Transmission Control Protocol/Internet Protocol) suite of protocols to prepare
and transmit data. TCP/IP uses the idea of sockets, which can be thought of as
the endpoint where data is dumped from the Internet into a computer and
organized for specific applications to use, much as a telephone turns
electrical signals into understandable sounds.
Like a telephone, a socket
must have an address, which is composed of the IP address of the computer (for
example 69.90.87.252) and the port number that the application receiving data from the
socket wishes to use. Port numbers are simply areas where data
can enter the computer remotely.
TCP/IP allows for 65,535 ports on
each computer. Ports between 1 and 1023 are the well known ports, which are reserved
for commonly used protocols and applications such as HTTP (port 80), the port
through which your computer receives web page information to display in
your browser, and FTP (23).
Registered ports are between 1024 and 49,151 and are
used by software developers who need their applications to communicate remotely with TCP/IP. Dynamic
and private ports are between 49,152 and 65,535 and are generally used when an application
(for example the audio/video chat feature in Microsoft's MSN Messenger) needs to create
additional connections on the fly after the initial connection (using a
registered port) has been made.
So to recap, a socket equals
a computer's IP address plus the port number that needs to be accessed. A socket
is necessary for a continuous flow of information to pass between two computers
using TCP/IP protocol, and therefore, for any Internet communication between a
server and a client computer.