Encryption

Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using an algorithm and a key. Only parties with the correct decryption key can reverse the process. Encryption is the foundational control for data confidentiality across all security domains.

Symmetric Encryption

Uses the same key for both encryption and decryption. Fast and efficient for large volumes of data.

Recommended Algorithms

Avoid: DES, 3DES, RC4, Blowfish, AES-ECB.

Why not ECB mode? ECB encrypts identical plaintext blocks to identical ciphertext blocks, leaking structural patterns. Always use an authenticated mode (GCM, CCM) or CBC with a separate MAC.

Key Distribution Problem

Symmetric encryption requires both parties to share the key securely before communication begins. This is typically solved by using asymmetric encryption to exchange the symmetric key (hybrid encryption).

Asymmetric Encryption

Uses a mathematically linked key pair: a public key (freely distributed) for encryption or signature verification, and a private key (kept secret) for decryption or signing.

Recommended Algorithms

Avoid: RSA-2048 for new systems (NIST recommends 3072+ post-2030), plain RSA (no padding), DSA.

Hybrid Encryption

In practice, all modern protocols combine both approaches:

1. Sender generates a random symmetric session key.
2. Session key is encrypted with the recipient's public key (asymmetric).
3. Data is encrypted with the session key (symmetric — fast for bulk data).
4. Recipient decrypts the session key with their private key, then decrypts the data.

Examples: TLS 1.3, PGP, Signal Protocol, SSH.

Encryption in Transit

Protects data moving between systems — networks, APIs, microservices, browsers.

Protocol Selection

Cipher Suite Guidance (TLS 1.2)

Prefer cipher suites that provide Perfect Forward Secrecy (PFS):

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

Disable: RC4, export ciphers, NULL ciphers, 3DES, anonymous DH.

Best Practices

• Enforce HSTS (HTTP Strict Transport Security) with max-age ≥ 1 year and includeSubDomains
• Submit to the HSTS preload list for public-facing services
• Implement certificate pinning for high-value mobile applications
• Use OCSP stapling to validate certificate revocation at scale
• Automate certificate renewal (Let's Encrypt / ACME protocol)
• Monitor TLS configuration regularly using tools like testssl.sh

Encryption at Rest

Protects data stored on disk, databases, backups, and removable media.

Layers of Protection

┌─────────────────────────────────────┐
│  Application-level encryption       │  ← Highest protection; survives DB breach
├─────────────────────────────────────┤
│  Database TDE (Transparent Data     │  ← Protects files on disk
│  Encryption)                        │
├─────────────────────────────────────┤
│  File-system / volume encryption    │  ← Protects against physical theft
├─────────────────────────────────────┤
│  Full-disk encryption (FDE)         │  ← Baseline; protects powered-off devices
└─────────────────────────────────────┘

Apply defense-in-depth. FDE is the minimum for all workstations and servers. Sensitive fields (PII, secrets, payment data) should also have application-level encryption.

Key Technologies

Key Management

Strong encryption is only as secure as its key management. A poorly managed key negates any algorithmic strength.

Key Hierarchy

Hardware Security Module (HSM) or Cloud KMS
  └── Key Encryption Key (KEK) — long-lived, rarely accessed
        └── Data Encryption Key (DEK) — rotated regularly
              └── Encrypted data

Best Practices

• Never hard-code keys in source code, configuration files, or container images
• Store all cryptographic keys in a dedicated key management system (KMS) or HSM
• Enforce separation of duties: key custodians must not also access the protected data
• Log every key access, generation, and revocation event
• Define and test emergency key rotation procedures for suspected compromise
• Establish key expiry — data encryption keys should expire after a defined period

Rotation Schedule

Common Pitfalls

Approved Cryptographic Libraries

Rule: Never implement cryptographic primitives yourself. Use a well-audited, widely deployed library.

Regulatory Reference