Common Criteria is essential particularly in these times of heightened Information security awareness. The CC Certification is verification that operating system has met a specific level of security. Consumers are more likely to purchase an operating system that is internationally accredited than one with just a good reputation.

This certification took Microsoft three years and millions of dollars to attain. Very few companies have time, money and resources to reach this level security. According to Microsoft they obtained Common Criteria “because its evaluation and certification process helps consumers make informed security decisions (Microsoft).”

Works Cited

Dinopolis. Common Criteria History. 11 May 2001. http://www.dinopolis.org/documentation/misc/theses/hhaub/node78.html

NIAP. Common Criteria Evaluation Verification Scheme. http://niap.nist.gov/

Electronic Privacy Center. Computer Security Act of 1987. http://www.epic.org/crypto/csa/

Microsoft. Windows 2000 achieves Common Criteria Certificate. 29 Oct 2002. http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/cccert.asp#top Radium. The Rainbow Series Library. 28 June 2000. http://www.radium.ncsc.mil/tpep/library/rainbow/

To digress a bit, have you ever wondered why you had to study prime numbers in school? I am sure most mathematics teachers do not know this answer. Answer: A subbranch called public-key cryptography which uses prime numbers especially for encrypting e-mails. Over there, they are talking of even bigger numbers like 2048, 4096, 8192 bits.)

When we want to encrypt something, we need to use a cipher. A cipher is just an algorithm similar to a recipe for baking a cake. It has precise, unambiguous steps. To carry out encryption process, you need a key (some called it passphrase). A good practice in cryptography needs key used by a cipher must be of high entropy to be effective.

Data Encryption Standard (DES), introduced as a standard in late 1970's, was most commonly used cipher in 1980's and early 1990's. It uses a 56-bit key. It was broken in late 1990’s with specialized computers costing about US$250,000 in 56 hours. With today's (2005) hardware, it is possible to crack within a day.

Subsequently, Triple-DES superseded DES as logical way to preserve compatibility with earlier investments by big corporations (mainly banks). It uses two 56-bit key using three steps:-

1. Encrypt with Key 1. 2. Decrypt with Key 2. 3. Encrypt with Key 1.

The effective key length used is only 112-bits (equivalent to 34 digits). The key is any number between 0 and 5192296858534827628530496329220095. Some modify last process using Key 3, making it more effective at 168-bit keys.

Advanced Encryption Standard (AES) was adopted as a standard by National Institute of Standards