Understanding Encryption: A Deep Dive with Code Examples

The primary objective of encryption is to ensure that only authorised parties can decipher the ciphertext back to plaintext and access the original information. Encryption doesn’t inherently prevent interference, but it denies the intelligible content to potential interceptors.

For technical reasons, an encryption scheme typically employs a pseudo-random encryption key generated by an algorithm. While it’s possible to decrypt a message without possessing the key, a well-designed encryption scheme demands considerable computational resources and expertise. An authorised recipient can effortlessly decrypt the message using the key provided by the originator, ensuring that unauthorised users cannot access the content.

🔏 Does Encrypted Mean Safe?

While encryption significantly bolsters the security of data, it doesn’t guarantee absolute safety.

*️⃣ Encryption Method

The method or algorithm used for encryption determines its strength. Modern encryption techniques, such as AES (256-bit mode), TwoFish, ChaCha20-Poly1305, and Serpent (configurable up to 512-bit), offer robust security. These methods are designed to withstand brute-force attacks due to the vast number of key possibilities.

🔢 Key Length

The length of the encryption key is a direct indicator of the strength of the encryption. For instance, DES (Data Encryption Standard) with a 56-bit key is now considered insecure due to vulnerabilities to brute-force attacks. Modern encryption standards often employ longer key sizes, typically 128-bit or higher, to ensure security.

🛅 Key Management

The security of encrypted data also hinges on the safe storage and management of encryption keys. If keys are compromised, the encrypted data becomes vulnerable.

⌨️ System Integrity

The device or system used for encryption must be free from vulnerabilities. Any compromise in system integrity can lead to potential decryption by unauthorised parties.

A Closer Look at Encryption Types with Coding Examples

🔑 Symmetric-Key Encryption

Symmetric-key encryption uses the same key for both encryption and decryption. Both the sender and the receiver must know and use the same secret key. The main challenge is securely distributing and managing the secret key.

Example: AES (Advanced Encryption Standard)

AES is a widely used symmetric encryption algorithm. It supports key sizes of 128, 192, or 256 bits.

Coding Example (Python using PyCryptoDome library)

from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes

key = get_random_bytes(16) # 128-bit key
cipher = AES.new(key, AES.MODE_ECB)
plaintext = “Hello, World!”
ciphertext = cipher.encrypt(plaintext.ljust(16))
print(“Encrypted:”, ciphertext)
decrypted = cipher.decrypt(ciphertext).strip()
print(“Decrypted:”, decrypted.decode())

🗝️ Public-Key (Asymmetric-Key) Encryption

In asymmetric encryption, two keys are used: a public key and a private key. The public key is used for encryption, while the private key is used for decryption. The public key can be shared openly, allowing anyone to encrypt a message, but only the holder of the private key can decrypt it.

Example: RSA (Rivest–Shamir–Adleman)

RSA is one of the first practical public-key cryptosystems.

Coding Example (Python using PyCryptoDome library)

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP

key = RSA.generate(2048)
private_key = key.export_key()
public_key = key.publickey().export_key()

recipient_key = RSA.import_key(public_key)
cipher_rsa = PKCS1_OAEP.new(recipient_key)
ciphertext = cipher_rsa.encrypt(b”Hello, World!”)
print(“Encrypted:”, ciphertext)

sender_key = RSA.import_key(private_key)
cipher_rsa = PKCS1_OAEP.new(sender_key)
decrypted = cipher_rsa.decrypt(ciphertext)
print(“Decrypted:”, decrypted.decode())

#️⃣ Hash Functions

Hash functions take an input and return a fixed-size string of bytes. The output, typically a digest, is unique to the given input. It’s a one-way function, meaning you can’t get the original data back. This property is useful in data verification, password storage, and more.

Example: SHA-256 (Secure Hash Algorithm 256-bit)

SHA-256 is a cryptographic hash function that produces a 256-bit (32-byte) hash value.

Coding Example (Python)

import hashlib

data = “Hello, World!”
hashed = hashlib.sha256(data.encode()).hexdigest()
print(“Hashed:”, hashed)

♦️ Tokenization

Tokenization replaces sensitive data with non-sensitive placeholders or tokens. Unlike encryption, where you can retrieve the original data from the encrypted data, tokenization does not allow such reversibility without access to the original tokenization system.

Example

Tokenizing credit card numbers in a payment system.

Coding Example (Python)

import uuid

class TokenizationSystem:
def __init__(self):
self.data_store = {}

def tokenize(self, data):
token = str(uuid.uuid4())
self.data_store[token] = data
return token

def detokenize(self, token):
return self.data_store.get(token, None)

system = TokenizationSystem()
token = system.tokenize(“1234-5678-9012-3456”)
print(“Token:”, token)
print(“Original Data:”, system.detokenize(token))

🗃️ Encryption at Rest vs. Encryption in Transit: A Comprehensive Overview

Two primary forms of encryption that organisations should be familiar with are “Encryption at Rest” and “Encryption in Transit.” Understanding the distinction between these two is crucial for ensuring data security across various scenarios. We will use Google’s approach to explain the difference between the two.

😶 Encryption at Rest: The Silent Guardian of Stored Data

Imagine the vast amounts of data stored on physical mediums, be it hard drives, SSDs, or backup tapes. This data, when static and stored, is vulnerable to threats like device theft, loss, or unauthorized physical access. Encryption at rest acts as its silent guardian. By using symmetric encryption algorithms like the Advanced Encryption Standard (AES), data is encrypted before being written to disk. When an authorized entity needs to access this data, it’s decrypted, ensuring that the stored data remains shielded from prying eyes.

Google’s approach to Encryption at rest
Google’s strategy for encryption at rest is both comprehensive and robust. In the realm of Google Cloud services, data is encrypted at rest by default. The tech giant doesn’t just stop at using AES; it also manages the cryptographic keys on behalf of its customers. This management can be through Google’s default encryption or, if customers prefer, their supplied encryption keys.

〰️ Encryption in Transit: The Shield for Data on the Move

While encryption at rest protects static data, what about data that’s on the move? As data traverses from one location to another, be it over the internet or between data centers, it’s susceptible to interception. This is where encryption in transit comes into play, acting as a shield for data in motion. Protocols like Transport Layer Security (TLS) or Secure/Multipurpose Internet Mail Extensions (S/MIME) for email encryption are commonly employed to ensure data remains untouched and secure during its journey.

Google’s approach to encryption in transit

Google’s approach to encryption in transit is a testament to its commitment to data security. The company ensures that data moving outside physical boundaries not under its control is encrypted. Google Front End (GFE) communications with users are secured using TLS. But Google’s efforts don’t end there. The company has been at the forefront of promoting encryption in transit through initiatives like open-source projects, including Certificate Transparency and Chrome APIs. Within its infrastructure, Google employs its Application Layer Transport Security (ALTS) for the authentication, integrity, and encryption of Google RPC calls. Furthermore, the PSP Security Protocol is used for network encryption, which not only ensures per-connection security but also supports the offloading of encryption to smart network interface card (SmartNIC) hardware.

🔣 Why Encryption is Important for GDPR Compliance

In the context of data protection and privacy, the General Data Protection Regulation (GDPR) stands as a landmark regulation in the European Union. One of the core tenets of GDPR is ensuring the security and confidentiality of personal data. Encryption plays a pivotal role in this regard. By encrypting personal data, organisations can effectively safeguard it against unauthorised access, breaches, and potential misuse. In the unfortunate event of a data breach, encrypted data remains unintelligible and useless to unauthorised parties, thereby reducing the risk of personal data being compromised.

Furthermore, GDPR explicitly mentions encryption as a recommended measure in Article 32, emphasising its importance in ensuring data security. Organisations that employ robust encryption practices not only bolster their data protection mechanisms but also demonstrate a commitment to GDPR’s principles, potentially mitigating legal repercussions and fines in case of data breaches. In essence, encryption acts as both a shield and a testament to an organisation’s dedication to data privacy and GDPR compliance.

”…the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.”