Encryption

​

Types of Encryption

​

Symmetric Encryption

1. Sender and receiver share a secret key
2. Sender encrypts data with the key
3. Receiver decrypts data with the same key

• Fast and efficient
• Lower computational overhead
• Suitable for bulk data encryption
• Key distribution is challenging
• Both parties must keep the key secret

• AES (Advanced Encryption Standard) - Industry standard, extremely secure
  • AES-128, AES-192, AES-256 (key sizes in bits)
• ChaCha20 - Modern alternative to AES, optimized for mobile
• Blowfish - Older but still secure
• DES/3DES - Legacy, no longer recommended

• Encrypting large amounts of data (PII, databases)
• File encryption
• Disk encryption
• VPN tunnels
• Secure messaging (after key exchange)
• HTTPS data transmission (after handshake)

​

Asymmetric Encryption

1. Receiver generates a key pair (public + private)
2. Receiver shares public key openly
3. Sender encrypts data with receiver’s public key
4. Only receiver can decrypt with their private key

• More secure for key distribution
• Private key never shared
• Slower than symmetric encryption
• Computationally expensive
• Not suitable for large amounts of data
• Enables digital signatures

• RSA (Rivest-Shamir-Adleman) - Most widely used
  • Key sizes: 2048, 3072, 4096 bits
• ECC (Elliptic Curve Cryptography) - Smaller keys, faster
  • ECDSA (Digital Signature Algorithm)
  • ECDH (Diffie-Hellman key exchange)
• DSA (Digital Signature Algorithm) - For digital signatures

• TLS/SSL handshake (HTTPS)
• Digital signatures
• Email encryption (PGP/GPG)
• SSH authentication
• Cryptocurrency transactions
• Software code signing

​

Comparison: Symmetric vs Asymmetric

​

Encoding vs Encryption vs Tokenization

​

Encoding

• Data transmission
• Data storage compatibility
• Not for security

• Easily reversible
• No key required
• Anyone can decode
• Not secure

• Base64 - Encodes binary to ASCII text
• URL encoding - Encodes special characters for URLs
• UTF-8 - Character encoding
• ASCII - Text encoding

Original: Hello, World!
Base64:   SGVsbG8sIFdvcmxkIQ==

​

Encryption

• Protect data confidentiality
• Prevent unauthorized access
• Secure data transmission

• Requires secret key
• Reversible (with correct key)
• Computationally difficult to break
• Maintains data format/size (approximately)

• Symmetric: AES, ChaCha20
• Asymmetric: RSA, ECC

Original:    Hello, World!
Encrypted:   U2FsdGVkX1+6J3Z... (ciphertext)
Key:         secretkey123

• Encrypting passwords (with proper hashing)
• Protecting sensitive files
• Securing network traffic
• Database encryption

​

Tokenization

• Data protection
• PCI DSS compliance
• Reduce security scope

• Original data stored securely in token vault
• Tokens are meaningless outside the system
• Cannot be reverse-engineered
• Maintains data format (optional)

1. Original data sent to tokenization system
2. System generates random token
3. System stores mapping in secure vault
4. Token returned for use in applications
5. Original data retrieved only when needed

Credit Card:    4532-1234-5678-9010
Token:          7893-4561-2890-3456

(Token has no mathematical relationship to original)

• Credit card number protection
• Social security numbers
• Personal identification numbers
• Healthcare records (HIPAA compliance)
• Payment processing (PCI DSS compliance)

​

When to Use Each

• You need to transmit binary data over text-based protocols
• You need to ensure data compatibility
• Security is not a concern

• You need to protect data confidentiality
• Data needs to be reversible
• You have secure key management
• You need to encrypt large amounts of data

• You need compliance (PCI DSS, HIPAA)
• You want to reduce security scope
• You’re storing payment card data
• You need format-preserving protection

​

Digital Signatures

​

How Digital Signatures Work

1. Generate key pair
   • Alice creates public key and private key
   • Private key kept secret, public key distributed
2. Create hash
   • Alice uses hash function (SHA-256) to create unique hash of document
   • Hash is fixed-length representation of document content
3. Encrypt hash
   • Alice encrypts hash with her private key
   • This encrypted hash is the digital signature
4. Attach signature
   • Digital signature is attached to document
   • Both are sent to recipient (John)

5. Extract signature and document
   • John receives document and digital signature
6. Decrypt signature
   • John uses Alice’s public key to decrypt the signature
   • This produces the original hash value
7. Calculate new hash
   • John calculates a new hash of the received document
   • Uses same hashing algorithm as Alice
8. Compare hashes
   • If calculated hash == decrypted hash:
     • Document is authentic (from Alice)
     • Document hasn’t been tampered with
   • If hashes don’t match:
     • Document has been modified
     • Or signature is invalid

​

Benefits of Digital Signatures

• Verifies identity of the signer
• Proves document came from claimed sender

• Detects any changes to document
• Even single character change invalidates signature

• Signer cannot deny signing
• Only person with private key could create signature

• Equivalent to handwritten signatures in many jurisdictions
• Accepted for contracts, agreements, etc.

​

Use Cases

• Software distribution (code signing)
• Email signing (S/MIME, PGP)
• PDF document signing
• Blockchain transactions
• SSL/TLS certificates
• Software updates verification

​

Encryption Best Practices

​

1. Use Strong Algorithms

• Symmetric: AES-256, ChaCha20
• Asymmetric: RSA-2048+ (prefer 4096), ECC-256+
• Hashing: SHA-256, SHA-3, bcrypt, Argon2

​

2. Proper Key Management

• Use cryptographically secure random number generators
• Never use predictable seeds
• Sufficient key length (256 bits for symmetric, 2048+ for RSA)

• Never hardcode keys in source code
• Use environment variables or key management services
• Encrypt keys at rest
• Use Hardware Security Modules (HSM) for critical keys

• Rotate keys regularly (annually or more frequently)
• Automate rotation process
• Maintain key version history

• Use secure channels for key exchange
• Never send keys via email or unencrypted channels
• Use key derivation functions (KDF) when appropriate

​

3. Encrypt Data at Rest and in Transit

• Database encryption (TDE - Transparent Data Encryption)
• File system encryption
• Backup encryption
• Mobile device encryption

• Always use TLS/SSL (HTTPS)
• Never transmit sensitive data over HTTP
• Use VPNs for remote access
• Encrypt email (PGP, S/MIME)

​

4. Use Authenticated Encryption

• AES-GCM (Galois/Counter Mode) - Most popular
• ChaCha20-Poly1305 - Modern alternative
• AES-CCM (Counter with CBC-MAC)

• Prevents tampering attacks
• Detects if ciphertext was modified
• Protects against chosen-ciphertext attacks

​

5. Protect Against Common Attacks

• Use authenticated encryption (GCM)
• Don’t reveal padding errors in responses

• Use constant-time comparison functions
• Avoid early returns based on decryption success

• Include timestamps or nonces
• Implement message counters
• Use session tokens

• Always verify certificates
• Implement certificate pinning
• Use mutual TLS for critical services

​

Encryption in Practice

​

Encrypting Passwords

// Don't do this!
const encrypted = encrypt(password, secretKey);
database.save(encrypted);

// Use password hashing with salt
const bcrypt = require('bcrypt');
const saltRounds = 10;

const hashedPassword = await bcrypt.hash(password, saltRounds);
database.save(hashedPassword);

// Verification
const isValid = await bcrypt.compare(password, hashedPassword);

​

Encrypting Sensitive Data

const crypto = require('crypto');

function encrypt(plaintext, key) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  
  let encrypted = cipher.update(plaintext, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  
  const authTag = cipher.getAuthTag();
  
  return {
    encrypted,
    iv: iv.toString('hex'),
    authTag: authTag.toString('hex')
  };
}

function decrypt(encrypted, key, iv, authTag) {
  const decipher = crypto.createDecipheriv(
    'aes-256-gcm',
    key,
    Buffer.from(iv, 'hex')
  );
  
  decipher.setAuthTag(Buffer.from(authTag, 'hex'));
  
  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  
  return decrypted;
}

​

Database Encryption

-- Encrypt sensitive columns
CREATE TABLE users (
  id INT PRIMARY KEY,
  email VARCHAR(255),
  encrypted_ssn VARBINARY(256),  -- Encrypted SSN
  encryption_key_id INT
);

-- Application handles encryption
INSERT INTO users (id, email, encrypted_ssn)
VALUES (1, '[email protected]', ENCRYPT('123-45-6789', @key));

• Encrypts entire database at storage level
• Transparent to application
• Protects against physical theft
• Available in most modern databases (MySQL, PostgreSQL, SQL Server)

​

File Encryption

# Encrypt file
openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc

# Decrypt file
openssl enc -d -aes-256-cbc -in file.txt.enc -out file.txt

# Encrypt file with public key
gpg --encrypt --recipient [email protected] file.txt

# Decrypt file with private key
gpg --decrypt file.txt.gpg > file.txt

​

Performance Considerations

​

Hardware Acceleration

• Hardware acceleration for AES
• 3-10x faster than software implementation
• Available on Intel/AMD processors since 2010

• Minimal performance impact
• Makes encryption practical for all data
• Reduces CPU overhead

​

Optimization Strategies

1. Use hardware acceleration - Enable AES-NI support
2. Batch operations - Encrypt multiple items together
3. Cache decrypted data - Balance security vs performance
4. Choose appropriate algorithms - ChaCha20 for mobile, AES for servers
5. Async encryption - Don’t block main thread

​

Compliance and Regulations

​

PCI DSS (Payment Card Industry)

• Encrypt cardholder data
• Use strong cryptography (AES-256)
• Secure key management
• Regular key rotation

​

HIPAA (Healthcare)

• Encrypt patient health information
• Both at rest and in transit
• Access controls and audit logs

​

GDPR (EU Data Protection)

• Encrypt personal data
• Pseudonymization requirements
• Right to be forgotten
• Data breach notification

​

SOC 2

• Encryption of sensitive data
• Key management procedures
• Access controls
• Regular security audits

​

Next Steps

• HTTPS/SSL - Learn how encryption secures web traffic
• Authentication - Secure user authentication
• JWT - Token-based authentication
• OAuth 2.0 - Secure authorization framework