During the past five years or so, however, the fortunes of encryption have risen dramatically. Industry groups have hammered out open standards. The Internet has increased both the number of attacks and the value of the properties that those attacks can threaten. Perhaps most important, encryption has moved off the edge; it can now be managed and delivered by the network, not the user. Virtual private network (VPN) technology is essentially about different ways of establishing and running totally encrypted sessions over otherwise insecure IP networks. Users establish these connections with special clients that handle the encryption management issues invisibly and in accordance with corporate policies.

Centralization has also added a function to encryption technology: management tools. For instance, encryption makes it much easier to enforce e-mail expiration policies. "The problem with e-mail that is unencrypted is that it’s hard to make sure you’ve gotten rid of all the copies," says Chuck Wade, a senior researcher at Cupertino, Calif.-based CommerceNet, a nonprofit, industry consortium that focuses on all aspects of e-commerce. "Generally, investigators will go after the desktop and laptop PCs of key individuals, since they know copies on the archive servers were disposed of long ago. If, on the other hand, you have to have access to a key server to decrypt these files, and the keys on that server have expiration dates, then the copies will be unreadable even if they survive."

All these improvements have led to a huge increase in the popularity of encryption. VPN sales are growing briskly. It is increasingly common for archiving and database software to encrypt the data they contain. Some industry observers, such as Raj Dhingra, senior vice president of marketing at Sunnyvale, Calif.-based Sonicwall, a firewall company moving into encryption, believe that encryption will become a standard element in corporate data privacy protection policies.

But while companies have warmed up to encryption, the popular technical culture has begun to cool on the technology. Schneier has publicly recanted his cryptocentric view of security in a new book, Secrets and Lies: Digital Security in a Networked World (Wiley, John & Sons, August 2000), in which he argues that encryption is just one link in a long chain, and that any failure in the chain will compromise even the best encryption. The two wings of the technical culture are not only converging; they may soon be passing each other, going in opposite directions.