Study Notes on Encryption Techniques

1. Data at Rest Encryption

Definition: Encrypting data stored on devices such as SSDs, hard drives, etc.

Methods:

Full Disk/Volume Level Encryption: Encrypts everything on the storage device.
File-Level Encryption: Encrypts individual files or folders.

OS Examples:

Windows: BitLocker for full disk encryption.
Mac OS: FileVault for full disk encryption.
Other operating systems often provide similar utilities or third-party options.

2. File-Level Encryption

Windows EFS (Encrypting File System): Built into the NTFS file system for encrypting individual files or folders.

How to Enable:

Right-click a file/folder, select Properties.
Go to Advanced Attributes and check "Encrypt contents to secure data".

Other systems (Mac OS, Linux, etc.) offer third-party utilities for similar functions.

3. Database Encryption

Transparent Encryption:

Uses a symmetric key to encrypt all data in a database.
Data is decrypted/encrypted on each access, which can introduce performance overhead.

Column-Level Encryption:

Encrypts only sensitive columns (e.g., Social Security numbers) while leaving other data in plain text.
Improves performance during searches since non-sensitive data remains unencrypted.

Example: An employee database where employee IDs, first names, and last names are in plain text, but Social Security numbers are encrypted.

4. Data in Transit Encryption

Purpose: Protect data as it travels between devices over a network.

Common Implementations:

HTTPS: Encrypts web traffic between your browser and web servers.
VPN (Virtual Private Network): Creates an encrypted tunnel for secure communication between sites or remote users.

VPN Protocols:

SSL/TLS for client-based VPNs.
IPsec for site-to-site VPN connections.

5. Encryption Algorithms & Compatibility

Algorithm Agreement: Both sides must agree on which encryption algorithm(s) to use to ensure successful encryption and decryption.

Trade-Offs:

Security level
Speed
Complexity of implementation

Examples:

DES (Data Encryption Standard): Uses five steps, including splitting data into left and right parts, producing a 64-bit ciphertext.
AES (Advanced Encryption Standard): Encrypts plaintext with a secret key and supports multiple versions for varied security levels.

Incompatible algorithms (e.g., encrypting with DES and decrypting with AES) will not work.

6. Public Algorithms & Key Secrecy

Algorithm Transparency: Encryption algorithms are generally public, and their workings are well known, which increases trust in their robustness.

Key Importance: The security of encryption lies in the secrecy of the key. Without the key, the encrypted data remains secure—even if the algorithm is public.

Analogy: Like a door lock, knowing how a lock works doesn’t grant access; you need the correct key.

7. Brute Force Attacks and Key Length

Brute Force Attacks: Attackers try every possible key combination to break the encryption.

Key Length:

Longer keys (e.g., 128-bit symmetric keys) are more resistant to brute force attacks.
Asymmetric keys often use lengths such as 3072 bits or larger.

As processing power increases, longer keys may be required for continued security.

8. Key Strengthening Techniques

Key Stretching/Strengthening: Involves performing the encryption or hashing process multiple times (e.g., hashing a password repeatedly) to increase resistance to brute force attacks.

This process adds computational overhead for attackers, making brute force attempts less feasible.

Summary

Encryption is critical for protecting data both at rest and in transit. Depending on the scenario, full disk encryption, file-level encryption, or database encryption can be implemented. Ensuring both parties agree on the same encryption algorithm is vital for secure communication. While encryption algorithms are public and transparent, the security of data is maintained through the secrecy and strength of the keys, with longer keys and key strengthening techniques serving as robust defenses against brute force attacks.