Encryption in practice — symmetric, asymmetric and certificates
Two kinds of keys hashing and how HTTPS binds it all together
Encryption is about making data unreadable to everyone except the one who has the right key — that is the core of confidentiality in IT security. But there is not just one type of encryption; different situations call for different techniques, and a technician should be able to distinguish between them.
§Symmetric encryption
With symmetric encryption the same key is used for both encrypting and decrypting data. AES (Advanced Encryption Standard) is the most common algorithm and is used among other things to encrypt hard drives and large data volumes because it is fast. The disadvantage is the key distribution problem: both parties must have the same secret key and it must at some point be safely transferred without a third party intercepting it.
§Asymmetric encryption
Asymmetric encryption — also called public key cryptography — uses a key pair: a public key which can be freely shared and a private key which never leaves the owner. Data encrypted with the public key can only be decrypted with the corresponding private key. RSA is a well-known algorithm of this type. The method solves the key distribution problem but is far more computationally intensive than symmetric encryption and is therefore typically only used to securely exchange a symmetric key after which the data stream itself is encrypted symmetrically.
§Hashing — something different from encryption
Hashing is not encryption because it cannot be reversed: a hash function converts data into a fixed-length value that you cannot compute backwards from. It is used to check integrity — has a file been changed since last time — and to store passwords so a technician or attacker who sees the database does not see the actual password, but only its hash.
| Symmetrical | Asymmetrical | Hashing | |
|---|---|---|---|
| Keys. | One shared key | Public + private key | No key |
| Can be redone | Yes, with the key | Yes, with private key | No, one-way |
| Typical use | Encrypt large amounts of data | Key exchange, signatures. | Integrity, access codes |
§TLS/HTTPS and certificates
When a browser establishes an HTTPS connection all three techniques are used together. Asymmetric encryption is used initially to agree a shared secret key safely; then the data stream itself is encrypted symmetrically because it's faster; and hashing is used to ensure data hasn't been changed along the way. The server's identity is confirmed with a certificate issued by a certificate authority binding a public key to a specific domain name — this is the basis for what's called PKI (Public Key Infrastructure).
“Encryption protects data on the way. It does not protect you against handing it over voluntarily to the wrong party.”
— Professional basic rule in IT security.