 is used to this subject, the treatment here will be quite cursory. encrypt and decrypt the data, in contrast to asymmetric We must first put the problem in its wider context. systems in which a public key is used to encrypt data and Most enterprise LANs have minimal internal authenti- a separate private key is used to decrypt it. Public key cation and no security, because it is presumed that systems are much more difficult to penetrate but very physical security of the Ethernet ports substitutes for computation-intensive and are used for the secure ex- systemic provisions of this nature (though those hardy change of symmetric keys but not for packet-by-packet souls charged with administering networks at universities encryption. The basic idea of the encryption approach is may find such presumptions laughable at best). Access to to use the key to create a pseudo-random binary string the network from the outside, however, is typically (the cipher stream) of the same length as the message to limited by a firewall that controls the type and destina- be encrypted. The data bits (the plaintext) can then be tion of packets allowed to enter and exit the local net- added modulo-2 (which is the same as a bit-by-bit ex- work. Remote users who have a need to use resources clusive or [XOR]) to the cipher stream to create the from an enterprise network may use a virtual private encrypted data or cipher text, which when added again to network (VPN), which is simply a logical link formed the same cipher stream will recover the original data between two clients, one at the remote site and the other (plaintext). The general scheme is shown in Figure 5.1-21. at the enterprise network, with all traffic between them A simple way to achieve such a result is to use the key being encrypted SO as to defeat all but the most de- as the seed value for a random number generator algo- termined eavesdropper. Traffic on the Internet is similarly rithm. The problem with this naive implementation is completely open to interception at every inter