ed that the eavesdropper knows the encryption and decryption algorithms but not the key. When a very high degree of security is required, it is also assumed that the eavesdropper has obtained (by other means) the plaintext corresponding to some of the intercepted ciphertext. In conventional or symmetric cryptosystems, it is easy to deduce the deciphering key from the enciphering key (they might even be the same), SO both must be kept secret. In public-key cryptosystems, however, the enciphering key can be made public by the recipi- ent. Despite this, it is believed to be computationally infeasible for an eavesdropper to work out the decipherment key. A further technique, public-key distribution (Diffie & Hellman, 1976) applies the same principles to the secure distribution of keys for conventional cryptosystems. In stream ciphers, a stream of plaintext symbols is enciphered symbol by symbol. Instead of a true one-time pad, the stream of enciphering symbols is generated by a symbol generator under the control of the enciphering key. A simple example for binary data is the use of a PseudoRandom Binary Sequence (PRBS) generator, initialized by the chosen key. This produces a stream of Os and 1s, which are XORed with the databit stream. Clearly, recovery of the original bitstream requires exactly the same operation, SO the decipherment key is the same as the encipherment key. Such systems are widely used in communications; their advantages include ease of encryption and decryption and the fact that single-bit errors Chapter 4 Coding in the channel cause only single-bit errors in the decrypted plaintext. Disadvantages include the effort of initial synchronization and resynchronization if synchronization is lost, and the fact that there is no transposition element in this system. In block ciphers, the message is divided into n-bit blocks, and the blocks are input sequentially to the algorithm. At each stage the key (which is usually constant for the whole message) is also entered, and the encryptor typically uses both 