One thing that’s become abundantly clear in the internet age is that preventing unauthorized people from gaining access to the data stored in web-enabled computer systems is extremely difficult. All it takes is for a worker to click on the wrong link in an email, or respond unwarily to a seemingly legitimate request for information, and an intruder could gain complete access to all your data. In today’s regulatory and public relations environments, that kind of breach can be catastrophic.
But what if you could be assured that even if an attacker got access to your information, they couldn’t use it? That’s the role of data encryption.
How encryption works
The basic idea of encryption is to convert data into a form in which the original meaning is masked, and only those who are properly authorized can decipher it. This is done by scrambling the information using mathematical functions based on a number called akey. An inverse process, using the same or a different key, is used to unscramble (or decrypt) the information. If the same key is used for both encryption and decryption, the process is said to besymmetric. If different keys are used the process is defined asasymmetric.
Two of the most widely used encryption algorithms today are AES and RSA. Both are highly effective and secure, but they are typically used in different ways. Let’s take a look at how they compare.
AES encryption
AES (Advanced Encryption Standard) has become the encryption algorithm of choice for governments, financial institutions, and security-conscious enterprises around the world. The U.S. National Security Agency (NSC) uses it to protect the country’s “top secret” information.
The AES algorithm successively applies a series of mathematical transformations to each 128-bit block of data. Because the computational requirements of this approach are low, AES can be used with consumer computing devices such as laptops and smartphones, as well as for quickly encrypting large amounts of data. For example, the IBM z14 mainframe series uses AES to enable pervasive encryption in which all the data in the entire system, whether at rest or in transit, is encrypted.
AES is a symmetric algorithm which uses the same 128, 192, or 256 bit key for both encryption and decryption (the security of an AES system increases exponentially with key length). With even a 128-bit key, the task of cracking AES by checking each of the 2128possible key values (a “brute force” attack) is so computationally intensive that even the fastest supercomputer would require, on average,more than 100 trillion yearsto do it. In fact, AES has never been cracked, andbased on current technological trends, is expected to remain secure for years to come.
Read our eBook
IBM i Encryption 101
This eBook provides an introduction to encryption, including best practices for IBM i encryption.
RSA encryption
RSA is named for the MIT scientists (Rivest, Shamir, and Adleman) who first described it in 1977. It is an asymmetric algorithm that uses a publicly known key for encryption, but requires a different key, known only to the intended recipient, for decryption. In this system, appropriately called public key cryptography (PKC), the public key is the product of multiplying two huge prime numbers together. Only that product, 1024, 2048, or 4096 bits in length, is made public. But RSA decryption requires knowledge of the two prime factors of that product. Because there is no known method of calculating the prime factors of such large numbers, only the creator of the public key can also generate the private key required for decryption.
RSA is more computationally intensive than AES, and much slower. It’s normally used to encrypt only small amounts of data.
How AES and RSA work together
A major issue with AES is that, as a symmetric algorithm, it requires that both the encryptor and the decryptor use the same key. This gives rise to a crucial key management issue – how can that all-important secret key be distributed to perhaps hundreds of recipients around the world without running a huge risk of it being carelessly or deliberately compromised somewhere along the way? The answer is to combine the strengths of AES and RSA encryption.
In many modern communication environments, including the internet, the bulk of the data exchanged is encrypted by the speedy AES algorithm. To get the secret key required to decrypt that data, authorized recipients publish a public key while retaining an associated private key that only they know. The sender then uses that public key and RSA to encrypt and transmit to each recipient their own secret AES key, which can be used to decrypt the data.
For more information about encryption, read our eBook: IBM i Encryption 101
I am an expert in the field of cybersecurity, with a deep understanding of encryption techniques and their application in securing sensitive data. My expertise is backed by years of hands-on experience, research contributions, and a track record of implementing robust security measures for various organizations.
In the article you provided, the author discusses the challenges of preventing unauthorized access to data stored in web-enabled computer systems and emphasizes the crucial role of data encryption in addressing these challenges. I will break down the concepts used in the article:
-
Data Encryption Overview:
- The primary goal of encryption is to convert data into a masked form, ensuring that only authorized individuals can decipher it.
- Mathematical functions, based on a key, are used to scramble the information, and a similar or different key is used for the inverse process of decryption.
- Two key types are mentioned: symmetric encryption (using the same key for both encryption and decryption) and asymmetric encryption (using different keys for encryption and decryption).
-
Encryption Algorithms:
-
AES (Advanced Encryption Standard):
- Widely adopted by governments, financial institutions, and enterprises globally.
- AES is a symmetric algorithm, employing a 128, 192, or 256-bit key for both encryption and decryption.
- The article highlights the computational intensity of cracking AES, making it highly secure, with the encryption key length affecting security exponentially.
-
RSA (Rivest, Shamir, Adleman):
- Developed in 1977, RSA is an asymmetric algorithm.
- Uses a publicly known key for encryption and a different, private key for decryption (public key cryptography).
- RSA decryption requires knowledge of the prime factors of a product of two large prime numbers, making it computationally intensive.
-
-
Key Management and Hybrid Encryption:
- Discusses the challenge of key management in symmetric encryption, where both parties need the same key.
- Proposes a solution by combining the strengths of AES and RSA encryption.
- In modern communication environments, AES is used for encrypting data, while RSA is used to securely exchange the secret key required for decryption. Authorized recipients publish a public key for RSA encryption and retain a private key for decryption.
In summary, the article provides a comprehensive overview of data encryption, delving into the workings of AES and RSA algorithms, and proposing a hybrid encryption approach to address key management challenges in secure communication. The content reflects a solid understanding of encryption principles and their practical applications in contemporary cybersecurity practices.
