Encryption-Working, Use-cases, and Challenges
By: Anav Chug
Tags: Challenges, Data At Rest, Working, Encryption, Use Cases

You might have read this message on your WhatsApp messenger that says “Messages you send to this chat and calls are now secured with end-to-end encryption.” Now, what WhatsApp means by this is that no third party including the WhatsApp team itself can read or listen to your conversations with any of your contacts. But what is encryption? And why exactly do we need it?

WhatsApp end-to-end encryption message

What is Encryption?

Encryption is the process of converting a human readable simple plain text or data into a complex cipher code before allocating that data into some storage system. The basic idea behind encryption is to prevent the data from being accessed by pernicious and unauthorized users. Any organization that deals with user data on a daily basis must utilize standardized encryption methods to ensure that their clients’ information is not stolen or compromised. It’s vital to remember that the encrypted data must be decrypted before it can be read.

How does encryption work?

In encryption, we make use of keys to encrypt and decrypt data. A key can be thought of as a combination of different numbers and letters that contains some information. It gives the data the appearance of a random cypher text. To perform these data transformations, two types of methods or algorithms are commonly used: Symmetric encryption and Asymmetric encryption.

· Symmetric Encryption- In this type of encryption, the keys that are used for encrypting and decrypting data are the same. It is considered relatively faster than asymmetric encryption due to this reason. Because the same key is used for encryption and decryption, keeping that key secure is a major challenge.

To understand symmetric encryption, let us take a hypothetical example in which we take a plaintext “Music” and use a key “2kf6453ke9” to encrypt it and generate a cipher text “X7bKECibg12.” We then use the same key “2kf6453ke9” to decrypt that cipher text back into the plaintext “Music.”

· Asymmetric (or public key) Encryption- In this type of encryption, the keys that are used for encrypting and decrypting data are different. The encryption key is called the public key and the decryption key is known as the private key. However, the public key does not need to be secured, and any unauthorized entity attempting to access it will be unable to decrypt any data.

Let us go back to our previous example in which we take the same plaintext “Music.” Notice that the only change in this example is in the type of keys used for encryption and decryption. Assume that the public key is the same (as used previously) and the private key is “3fy451oc8.”

Why do we need encryption?

The CIA triad model is adhered to by the vast majority of security systems and policies. CIA is an abbreviation for Confidentiality, Integrity, and Availability. Encryption ensures that data communicated between users remains confidential, that its integrity is maintained, and that it is always available for use.

Confidentiality means that the data must be kept private and should be out of the reach of unauthorized users. It also ensures that no malicious user can access or interpret the data in any way.

Integrity refers to the fact that the data transmitted or provided by the user must be accurate and not tampered with.

Availability means that the data is readily available and accessible to the clients as well as to those within the organization. All the systems including various servers and networks must be working.

Types of Data that is encrypted-

· Data in-transit- Data that is moving (or is in-transit) needs to be encrypted before its transmission, decrypted, and verified at its destination. Uploading files to a cloud storage service, completing a form on a website, or checking your blood pressure using an app are all examples of data in transit. The HTTPS or TLS 1.2 protocol is commonly used for encryption. This protocol works by dividing the data into several sections, mixing them together using an algorithm and a public key, and then unpacking it with a private key.

Data stored in pen drive, HDD, or cloud is said to be at rest

· Data at rest- Data is considered to be at rest if it is not being used or sent and is stored on a storage device such as a hard disc, the cloud, or a pen drive. This information is safeguarded by a variety of security access controls that govern what data can be accessed and by whom. The encryption algorithms used to encode such data must be extremely strong, such as RSA and AES, which are asymmetric and symmetric encryptions respectively. It is also advised that the complete database, as well as the fields containing Protected Health Information (PHI) such as name, age, and date of birth, be encrypted.

Use cases of Encryption

· It aids in the protection of data stored in databases.

· It’s used in cloud-based apps to encrypt various storage systems.

· It facilitates in the secure processing of payments.

· It’s a popular choice for digital signatures.

· Communication platforms such as WhatsApp and Signal use it.

Encryption Challenges

· If the user loses the decryption keys and does not make any copies of his data, he may suffer data loss.

· Using encryption methods can be a difficult process, and some users may handle these tools incorrectly, putting their data’s security at risk.