Encryption

Encryption
Encryption is when data is scrambled (coded) so that the data cannot be understood.
Decryption is accessing encrypted data legitimately.

Technically, encryption is the process of converting plaintext to ciphertext.

(Encrypted data is called ciphertext, whereas data before it is encrypted is called
plaintext).

Encryption does not prevent cyber criminals intercepting data, but it does prevent them
from understanding it.

How does encryption work?

The computer sending the message uses an encryption key to encode the data.
The receiving computer has a corresponding decryption key that decodes (translates)
the data back again (reversing the encryption).

1
 Advantages of Encryption
1) Data is more secure during transmission.

2) Secure data can only be read by people with the correct key for decryption.

3) Helps people feel more confident when sending personal data over the internet.

4) Protocols means people use the same rules and standards.

5) Encryption protocols work across a range of digital devices.

6) It increases people's trust in using the internet and sending data.

Disadvantages of Encryption
1) If you forget the password or lose the encryption key, you cannot get access to the
data.

2) If you use simple passwords or keys then people may guess them and get access to
your data.

3) It takes time to encrypt data. This means that data transmission may be slower,
especially when sending large amounts of data.

4) Encryption requires additional processing power. It uses up valuable memory for both
the client and the server. Encryption involves the use of keys and while a larger key
size means more effective encryption, it also increases the computational power
required to perform the encryption.

5) Some encryption protocols rely only on public keys. These may be easier to break.

6) If the private key is lost, it is extremely difficult to recover the data and, in certain
circumstances, the data may we l be lost permanently.

7) Encryption protocols can increase the amount of network traffic, which can slow down
a network.

2
 Encryption Methods
1) Symmetric encryption
2) Asymmetric encryption

Symmetric Encryption
Symmetric encryption involves the sending computer (user) and the receiving
computer (user) having the same secret key (private key) to encrypt and decrypt a
message.

The sender has to send the encryption key to the recipient before they can decrypt the
message. This could be done at a separate time.

With symmetric encryption, there is the risk that the encryption key could be
intercepted by anybody and used to decrypt the message.

Symmetric encryption is faster than asymmetric encryption as it doesn’t take a lot of

time and processing to decrypt data.

Asymmetric Encryption
Asymmetric encryption (public-key encryption) uses two different keys – a public
key and a private key.

The public key is used to encrypt the data. The private key is used to decrypt the data.

The public key is available to anybody wanting to send data. The private key is known
only to the recipient.

Asymmetric encryption is more secure than symmetric encryption, as the decryption

key does not have to be transmitted,

Advantages & Disadvantages of Encryption Methods

Symmetric Encryption vs Asymmetric Encryption
1) Symmetric encryption is faster and more efficient, making it ideal for encrypting large
volumes of data. Asymmetric encryption is much slower due to its mathematical
complexity, and it is therefore not suitable for computing vast amounts of data.

2) Asymmetric encryption requires greater computational power.

3) Asymmetric encryption provides a higher level of security by allowing secure

communication without the need to share a secret key, as the private key is never
exposed.

3
 Encryption Protocols
Protocol is a set of rules.

Encryption protocol is a set of rules for encrypting data.

SSH (Secure Shell)

SSH (Secure Shell) is an encryption protocol used for remotely logging on to a
computer network, securely.

SSH can also be used for transferring data from one computer to another.

IPSec (Internet Protocol Secure)

IPSec (Internet Protocol Secure) is a protocol used to keep data secure when it is sent
over a public network (such as the internet).
It can also be used to secure Virtual Private Networks (VPNs).

Devices are authenticated to each other, thereby ensuring data integrity.

IPSec uses the concept of keys to encrypt the data in each packet.
Data is split into packets when sent over the internet or a network.
IPSec authenticates packets before they are sent along a network.
This means that the packets are secure, and the receiving computer can check that they
are authentic.
The computer that receives the encrypted packets uses decryption to reveal the data in
each packet.

IPsec commonly includes three protocols:

1) Authentication Header (AH) protocol
used to authenticate data packets

2) Encapsulating Security Payload (ESP) protocol

both authenticates and encrypts the data packets

3) Internet Key Exchange (IKE) protocol

generates security associations (SA) used to negotiate the encryption keys and
algorithms which will be used in a session

SSL/TLS
SSL (Secure Sockets Layer) is a security protocol used for making websites secure.
It uses asymmetric encryption.
Once SSL has established an authenticated session, the client and server will create
symmetric keys for faster, secure communication.

TLS has replaced SSL but they are both often referred to as SSL.

4
 Purpose of IPSec
To protect confidential data and to provide secure transfer of this data across a public
network such as the internet.
It is aimed at preventing interception of data by hackers as well as protecting the data
being transmitted from being understood.
In short, IPsec provides authentication, integrity and confidentiality of data.

Use of IPSec in Client–Server Communication

IPsec is used for protecting confidential data transmitted across a network.

The main use of IPsec, however, is in virtual private networks (VPNs).

A VPN creates a secure connection between two computers over the public internet. It is
almost as secure as a private internal network such as a LAN.
It is used so that employees working from home on a client computer can access
confidential files securely from the company’s server as though they were working in the
company’s offices.

5
 Purpose of SSL/TLS
1) Enable encryption in order to protect data.

2) Make sure that the people/companies exchanging data are who they say they are
(authentication).

3) Ensure the integrity of the data to make sure it has not been corrupted or altered.

4) Ensure that a website meets the Payment Card Industry Data Security Standard (PCI
DSS) rules.
The PCI DSS was set up so that company websites could process bank card
payments securely and to help reduce card fraud. This is done by setting standards for
the storage, transmission and processing of bank card data that businesses deal with.

5) Improve customer trust. If customers know that a company is using the SSL/TLS
protocol to protect its website, they are more inclined to do business with that
company.

6) Many websites use SSL/TLS when encrypting data while it is being sent to and from
them. This keeps attackers from accessing that data while it is being transferred.
The SSL/TLS protocol enables the creation of a secure connection between a web
server and a browser.
Data that is being transferred to the web server is protected from eavesdroppers
(people who try to intercept internet communications).

7) Any website with an HTTPS address uses SSL/TLS. SSL/TLS verifies the identity of
the server.
In order to verify the identity of the server, the protocol makes use of digital
certificates, which contain such information as the
✓ domain name that the certificate is issued for
✓ which organisation, individual or device it was issued to
✓ the certificate authority (CA) that issued it
✓ the CA’s digital signature
✓ the public key
as well as other items.

A website needs a digital certificate in order to verify ownership of the website and
also to prevent fraudsters creating a fake version of the website.

Valid SSL/TLS certificates can only be obtained from a CA.

CAs can be private companies or even governments.
Before allowing someone to have an SSL/TLS certificate, the CA will carry out a
number of checks on an applicant and following that, it is the responsibility of the CA
to make sure that the company or individual receives a unique certificate.

6
 Use of SSL/TLS in Client–Server Communication
Transport layer security (TLS) is used for applications that require data to be securely
exchanged over a client–server network, such as web browsing sessions and file
transfers.
Just like IPsec it can enable VPN connections and Voice over IP (VoIP).

In order to open an SSL/TLS connection, a client needs to obtain the public key.
Consider the client to be a web user or a web browser and the server to be the website.
The public key is found in the server’s digital certificate. From this we can see that the
SSL/TLS certificate proves that a client is communicating with the actual server that owns
the domain, thereby proving the authenticity of the server.
When a browser (client) wants to access a website (server) that is secured by SSL/TLS,
the client and the server must carry out an SSL/TLS handshake. A handshake, in IT
terms, happens when two devices want to start communicating.
One device sends a message to the other device teling it that it wants to set up a
communications channel. The two devices then send several messages to each other so
they can agree on the rules for communicating (a communications protocol). Handshaking
occurs before the transfer of data can take place.
With an SSL/TLS handshake, the client sends a message to the server telling it what
version of SSL/TLS it uses together with a list of the different ciphersuites (types of
encryption) that the client can use. The list of ciphersuites has the client’s preferred type at
the top and its least favourite at the bottom. The server responds with a message which
contains the ciphersuite it has chosen from the client’s list.
The server also shows the client its SSL certificate. The client then carries out a number of
checks to make sure that the certificate was issued by a trusted CA and that it is in date
and that the server is the legitimate owner of the public and private keys. The client now
sends a random string of bits that is used by both the client and the server to calculate the
private key. The string itself is encrypted using the server’s public key. Authentication of
the client is optional in the process. The client sends the server another message,
encrypted using the secret key, te ling the server that the client part of the handshake is
complete. We wi l see in more detail in the section on HTTPS how any further transmitted
data is encrypted.

7
 Need for SSL/TLS and IPSec
Most networking/communication protocols, such as TCP/IP (which manages the
sending and receiving of data) are not automatically secure. They do not secure the
data with encryption. This means that data can be intercepted and read more easily.

SSL/TLS and IPSec add security to data before it is sent to other computers.
This means it is far more difficult to access the data if it is intercepted by hackers.

Thus, SSL/TLS and IPSec are needed to secure data.

Advantages & Disadvantages of Encryption Protocols

SSL/TLS vs IPSec
1) The management of digital certificates is less of a problem with SSL/TLS compared to
IPsec, which could lead to saving of time and money. With SSL/TLS, digital certificates
are only essential with the server (client digital certificates are optional), whereas with
IPsec both client and server have to be authenticated, which makes it more difficult to
manage an IPsec system.

2) Another cost implication is that, unlike most uses of IPsec, you do not need to buy
client software for SSL/TLS and the process of setting up and managing such a
system tends to be easier.

3) Extra software has to be downloaded when using SSL/TLS if non-web-based

applications are used, which may be a problem if a firewall prevents or slows down
access to these downloads.

4) As user authentication is optional, this means that security is weakened with SSL/TLS
compared to IPsec.

5) VPN tunnels using SSL/TLS are not supported by certain operating systems which do
support IPsec.

8
 Uses of Encryption
1) Data protection
2) Systems encryption
3) Hard-disk encryption
4) Email encryption
5) HTTPS websites encryption

Data Protection
There are many reasons to encrypt data:

✓ Companies often store confidential data about their employees, which could include
medical records, payroll data, as well as personal data. These need to be encrypted to
prevent them becoming public knowledge.

✓ A company’s head office may wish to share sensitive business plans to worry about
what would happen if it were intercepted.

✓ An employee in a shared office may not want others to have access to their work
which may be stored on a hard disk, so it needs to be encrypted.

✓ Company employees and individuals may need to take their laptops or other portable
devices with them when they travel for work or pleasure. If the device contains
sensitive information which is not encrypted, it is possible that the information could be
retrieved by a third party if the device is left unattended.

✓ When individuals are emailing each other with information they would want to remain
confidential. They need to prevent anybody else from reading and understanding their
mail.

✓ People use websites for online shopping and online banking. When doing so, the
debit/credit card and other bank account details should be encrypted to prevent
fraudulent activity taking place.

9
 Systems Encryption
Systems encryption is the encryption of the system or file system (FBE) being used.

Many operating systems have encryption systems. If you enter your password incorrectly
too many times, the system will think someone is trying to hack it. It will then stop any
more attempts at gaining access. This is called 'locking' the system. Once a system is
locked, it will require a Recovery Key to allow access again.

Filesystem-level encryption or file-based encryption (FBE) is when individual files or

directories are encrypted by the file system itself.
FBE can allow different files to be encrypted using different keys, thereby making it even
more difficult for hackers to unencrypt all the data in a system.
It does not encrypt metadata such as the time the file was modified or its size.
FBE is different to full disk encryption which involves encrypting the whole disk.

Hard-disk Encryption
When a file is written to the disk, it is automatically encrypted by specialised software.
When a file is read from the disk, the software automatically decrypts it while leaving all
other data on the disk encrypted.

Advantages
1) The whole disk is encrypted, including data files, the OS and any other software on the
disk. Full (or whole) disk encryption is your protection should the disk be stolen, or just
left unattended. So, even if the disk is still in the original computer, or removed and put
into another computer, the disk remains encrypted and only the keyholder can make
use of its contents.

2) Full disk encryption is that it automatically encrypts the data as soon as it is saved to
the hard disk. You do not have to do anything, unlike the encryption of files and
folders, where you have to individually encrypt them as you go.

Disadvantages
1) If an encrypted disk crashes or the OS becomes corrupted, you can lose all your data
permanently or, at the very least, disk data recovery becomes problematic.

2) It is important to store encryption keys in a safe place, because as soon as a disk is

fully encrypted, no one can make use of any of the data or software without the key.

3) Booting up the computer can be a slower process.

Hard-disk encryption is not limited to disks and can be used on other storage media
such as backup tapes and Universal Serial Bus (USB) flash memory.

10
 Email Encryption
Email encryption has three parts:
1) The first is to encrypt the actual connection from the email provider, because this
prevents hackers intercepting and acquiring login details and reading any messages
sent (or received) as they leave (or arrive at) the email provider’s server.
2) Then, messages should be encrypted before sending them so that even if a hacker
intercepts the message, they will not be able to understand it. They could still delete it
on interception, but this is unlikely.
3) Finally, since hackers could bypass your computer’s security settings, it is important to
encrypt all your saved or archived messages.

Asymmetric encryption is the preferred method of email encryption. The email sender
uses the public key to encrypt the message while the recipient uses the private key to
decrypt it.

Encryption only scrambles the message contents, not the sender’s email address, making
it very difficult to send messages anonymously.

Most types of email encryption require the sending of some form of digital certificates to
prove authenticity. The management of digital certificates, though time-consuming, is
crucial, as users would not want them to fall into the hands of hackers.

11
 HTTPS Websites Encryption
HTTP (Hypertext Transfer Protocol) is the protocol used by web browsers and web
servers.
Unfortunately, it is not encrypted and so can cause internet traffic to be intercepted, read
and understood. Hackers could intercept any private information including bank details
and then use these to commit fraud.

HTTPS (Hypertext Transfer Protocol Secure) enables users to browse the world wide
web securely.
To do this, it uses the HTTP protocol but with SSL/TSL encryption.
HTTPS websites have a digital certificate issued by a trusted CA, which means that
users know the website is who it says it is; it proves it is authentic.
HTTPS ensures the integrity of the data by showing that web pages have not been
changed by a hacker while being transferred and by encrypting any information
transferred from the client to the server, and vice versa.

As a result of the use of HTTPS, users can securely transmit confidential information such
as credit card numbers, social security numbers and login credentials over the internet.
If they used an ordinary HTTP website, data is sent as plain text, which could easily be
intercepted by a hacker or fraudster.

Indicators that you are using a secure site are:

1) The inclusion of the HTTPS:// prefix as the starting part of the URL.
2) A padlock icon next to the URL.
Depending on your browser and the type of certificate the website has installed,
the padlock may be green.

How does HTTPS work?

1) The web browser on the client computer performs a handshake with the web server.
2) Then, a session key is created randomly by the web browser and is encrypted using
the public key, then sent to the server.
The generation of the session key is done through asymmetric encryption, but
symmetric encryption is used to encrypt all further communications.
Asymmetric encryption requires a lot of processing power and time, so HTTPS uses a
combination of asymmetric and symmetric encryption.
3) The server then decrypts the session key using its private key.
4) All data sent between the two from then on is encrypted using this session key.
5) Once the session is finished, each client and the server discard the symmetric key
used for that session, so each separate session requires a new session key to be
created.

Advantages
1) HTTPS ensures security of data, with information remaining confidential because only
the client browser and the server can decrypt it.

2) Search engine results tend to rank HTTPS sites higher than HTTP sites.

12
Disadvantages
1) The time required to load an HTTPS website tends to be greater.
2) Websites have to ensure that their SSL certificate has not expired and this creates
extra work for the host as it has to keep on top of certificate management.

13