Scribd
Upload
3 views2 pages

Encryption Standards Overview and Best Practices

The document outlines encryption standards, specifying AES-256 for data at rest and TLS 1.3 for data in transit. It emphasizes the use of Argon2 for password hashing and secure key management practices. Additionally, it details protocols for end-to-end encryption, key exchange, and backup security.

Uploaded by

Richard Ndungu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
3 views2 pages

Encryption Standards Overview and Best Practices

The document outlines encryption standards, specifying AES-256 for data at rest and TLS 1.3 for data in transit. It emphasizes the use of Argon2 for password hashing and secure key management practices. Additionally, it details protocols for end-to-end encryption, key exchange, and backup security.

Uploaded by

Richard Ndungu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Encryption Standards

 Data at Rest:

 Algorithm: AES-256 (Advanced Encryption Standard) with GCM mode for authenticated
encryption.

 Key Management: cloud-based key management services (e.g., Google Cloud KMS).

 Implementation: Encrypt databases, backups, and file storage. Ensure keys are rotated
regularly.

 Data in Transit:

 Protocol: TLS 1.3 with strong cipher suites

 Certificates: Use ECC (Elliptic Curve Cryptography) certificates with 256-bit keys for
better performance and security.

 Validation: Enforce certificate pinning and revoke expired/invalid certificates.

 End-to-End Encryption:

 Use Signal Protocol or similar for messaging or sensitive communications.

 Implement public-key cryptography (e.g. RSA-4096) for secure key exchange.

 Password Storage:

 Hash passwords using Argon2 (memory-hard, resistant to GPU-based attacks) with a


high cost factor.

 Alternatively, use bcrypt or PBKDF2 with sufficient iterations.

 Key Exchange:

 Use ECDH (Elliptic Curve Diffie-Hellman) for secure key exchange.

 Backups

 Encrypt all backups using AES-256-GCM to ensure confidentiality and integrity.

 Use separate encryption keys for backups, distinct from primary data encryption keys, to
limit the impact of a key compromise.

 Recovery Paths:

 Encrypt recovery data (e.g., backup codes, recovery tokens, or temporary credentials)
using AES-256-GCM during storage and transmission.

 encrypt the data with a data encryption key (DEK), and encrypt the DEK with a key
encryption key (KEK) stored in an HSM or KMS.
Summary
Encryption Standards: Mandates AES-256 for data at rest, TLS 1.3 for data in transit, Argon2 for
password hashing, and secure key management practices.

You might also like