The major goal of encryption is to prevent data from being read by any third party.
A digital signature is a mechanism by which a message is authenticated i.e. proving that a message is coming from a given sender
Refers to the application of encryption on data, while on storage media, eg disks.
Can we be sure that current encryption methods will remain secure in the future.
From the IDC publication "When it comes to encryption, the rule of thumb is that "you want your messages to provide 20 years or more of security, so you want any encryption that you use to remain strong 20 years from now,"
We can use hashing to secure passwords. BUT NOTE: HASHING IS NOT ENCRYPTION
We can use hashing to provide a means to ensure that data is not altered. HASHING IS NOT ENCRYPTION
Is it likely to be an issue to use the term encryption in the DCAT when talking about hashing, given that formally hashing isn't encryption, but it is common to refer to hashing as one way encryption? If a student refers to a hashed value as encrypted, and that it can't be decrypted. Is that perfectly acceptable
In the strictest sense cryptographic hash functions aren't encryption.
Cryptographic hash functions are a subset of hash functions in general.
Hash functions that are used for search algorithms or check digits aren't generally suitable for cryptographic purposes.
But hash functions used for things like passwords and other cryptographic purposes provide a form of encryption. So, if the student has said that an algorithm like SHA has been applied, then it would make sense to refer to the hashed value as encrypted. But if the hash value came from the Luhn algorithm (used for credit card check digits), then no, it's not encrypted - given a check digit, it's very easy to find a credit card number that produces that digit!
If the student showed an understanding of the whole hashing process, I don't think that would be an issue, but if their fuller description implied that it was a reversible encryption using a key, that would show a misunderstanding of the main point.
Begins with an explanation of how you might imagine two devices might start the communication process.
Then introduces the problem; the man in the middle
And lastly how it is solved using Digital Certificates
If you are trying to purchase a certificate for a website or to use for encrypting MQTT you will encounter two main types:
Domain Validated Certificates (DVC)
Extended validation Certificates (EVC)
The difference in the two types is the degree of trust in the certificate which comes with more rigorous validation.
The level of encryption they provide is identical
A domain-validated certificate (DV) is typically used for Transport Layer Security (TLS) where the identity of the applicant has been validated by proving some control over a DNS domain.
The validation process is normally fully automated making them the cheapest form of certificate. They are ideal for use on websites like this site that provides content, and not used for sensitive data.
An Extended Validation Certificate (EV) is a certificate used for HTTPS websites and software that proves the legal entity controlling the website or software package. Obtaining an EV certificate requires verification of the requesting entity’s identity by a certificate authority (CA).
They are generally more expensive than domain validated certificates as they involve manual validation.
A 1024 bit RSA key is only reasonably secure, can be cracked by a fairly determined hacker with sufficient computing power.
A 2048 bit RSA key is predicted to be secure until 2030.
The problem with making these keys longer is that the computation complexity increases and the speed of encryption slows down drastically.
RSA is used to come up with a public/private key pair for asymmetric (“public-key”) encryption.
Diffie-Hellman is used to generate a shared secret in public for later symmetric (“private-key”) encryption.
When it comes to encryption, the rule of thumb is that "you want your messages to provide 20 years or more of security, so you want any encryption that you use to remain strong 20 years from now," says IDC's Kolodgy.
When will quantum computing threaten the status quo? "We don't know. To many people, 20 years seems a long way off, but in the world of cybersecurity, it's right around the corner. "Is that an acceptable risk? I don't think so. So we need to start figuring out what alternatives to deploy, since it takes many years to change the infrastructure," Michele Mosca, deputy director of the Institute for Quantum Computing at the University of Waterloo in Ontario.
1973 IBM created a block cipher to protect customer data.
1977 It was adopted by the US as a national standard called DES.
56-bit DES in wide use until...
1997 DES cracked in 96 days.
1998 3DES or triple DES released (112 or 168 bit keys)
2002 DES cracked in 23 hours (AES would take billions of years to crack)
2001 AES replaces DES as the US Gov recommended standard, key sizes; 128, 192, or 256 bits.
To crack a 256-bit key, would need to try 2256 different combinations.
Which is 78 digits long and several orders of magnitude greater than the number of atoms in the observable universe.
So, for all practical purposes, AES-256 is virtually impenetrable - today.
AES encryption is still widely used in modern applications.
2005 DES retired
2018 NIST announced 3DES not to be used for new applications and usage is disallowed after 2023.
2030 Quantum computing?
1976 Diffie & Hellman proposed 2 separate keys for encryption/decryption.
1977 RSA algorithm developed. Key sizes: 1024-bit to 4096-bit
2003 RSA Security claim 1024-bit RSA keys likely crackable around 2006 to 2010.
2015 NIST recommend minimum of 2048-bit RSA key
2020 Largest RSA key publicly known to be cracked is RSA-250 with 829 bits.
2030 Quantum computing?
Asymmetric key computation is more intensive computationally and requires much longer keys to make it defensible. EG:
A 1024 bit RSA key is only reasonably secure, can be cracked by a fairly determined hacker with sufficient computing power.
A 2048 bit RSA key is predicted to be secure until 2030.
The problem with making these keys longer is that the computation complexity increases and the speed of encryption slows down drastically.
From Wikipedia:
1024-bit RSA keys are equivalent in strength to 80-bit symmetric keys,
2048-bit RSA keys to 112-bit symmetric keys
3072-bit RSA keys to 128-bit symmetric keys
15360-bit RSA keys to 256-bit symmetric keys.
Encryption helps protect your online privacy by turning personal information into “for your eyes only” messages intended only for the parties that need them — and no one else.
You should make sure that your emails are being sent over an encrypted connection, or that you are encrypting each message.
Most email clients come with the option for encryption in their Settings menu, and if you check your email with a web browser, take a moment to ensure that SSL encryption is available.
Cybercrime is a global business, often run by multinational outfits.
Many of the large-scale data breaches that you may have heard about in the news demonstrate that cybercriminals are often out to steal personal information for financial gain.
The Health Insurance Portability and Accountability Act (HIPAA) requires healthcare providers to implement security features that help protect patients’ sensitive health information online.
Institutions of higher learning must take similar steps under the Family Education Rights and Privacy Act (FERPA) to protect student records.
Retailers must contend with the Fair Credit Practices Act (FCPA) and similar laws that help protect consumers.
Encryption helps businesses stay compliant with regulatory requirements and standards. It also helps protect the valuable data of their customers.
On average a computer connected to the internet will be the target of an attempted hack every 39 seconds.
OR on average, a computer will be the target of 2,224 hacking attempts every day.
Cybercrime damage costs are predicted to hit $6 trillion annually by 2021.
Cybersecurity spending will exceed $1 trillion from 2017 to 2021.
The world will have 3.5 million unfilled cybersecurity jobs by the end of 2021.
Ransomware damage costs are predicted to grow more than 57 times from 2015 to 2021 reaching $20 billion by 2021.
70 percent of cryptocurrency transactions will be for illegal activity by 2021
Encryption is designed to protect your data, but encryption can also be used against you.
For instance, targeted ransomware is a cybercrime that can impact organizations of all sizes, including government offices. Ransomware can also target individual computer users.
How do ransomware attacks occur? Attackers deploy ransomware to attempt to encrypt various devices, including computers and servers. The attackers often demand a ransom before they provide a key to decrypt the encrypted data. Ransomware attacks against government agencies can shut down services, making it hard to get a permit, obtain a marriage license, or pay a tax bill, for instance.
Targeted attacks are often aimed at large organizations, but ransomware attacks can also happen to you.
It was estimated that every 40 seconds a business falls victim to a ransomware attack, in a December 2016 security bulletin posted by the cybersecurity firm Kaspersky Lab, which stated that the number of attacks rose from every two minutes in early 2016.
The news that Interpol is about to “condemn” the spread of strong encryption is just the latest salvo in the crypto wars, a decades-long controversy between proponents of strong encryption, law enforcement and investigative bodies over the widespread use of encryption by technology companies. The central tenet of the law enforcement argument is that strong end-to-end encryption hinders the investigation and prosecution of crimes when suspects use it on their personal devices. For their part, privacy and human rights advocates contend that there is no mechanism “that (both) protects the security and privacy of communications and allows access for law enforcement”.
Facebook Messenger, WhatsApp and other communication apps use an implementation of public key cryptography called end-to-end encryption. Only the end users have access to the decrypted data; the service provider, like Facebook, doesn’t. As such, it is theoretically impossible for the company to hand over decrypted data to the authorities.
This is the crux of the debate. It is what has led law enforcement to ask that end-to-end encryption not be rolled out by Facebook, or that 'backdoors' be introduced to aid in surveillance or data recovery.
The UK’s Online Safety Bill promises to help law enforcement fight crime more effectively across the internet. Critics say its encryption provisions will force big tech out of the country.
While quantum computing is still in its infancy, it is a fact that mathematical problems which are considered computationally “too intensive” for today’s computers may not be so for quantum computers. Should that happen, the defensibility of today’s encryption algorithms could disappear or be seriously compromised.
Not surprisingly, asymmetric encryption algorithms (which are weaker and less defensible computationally) are likely to be the main casualties of quantum computing. But, work is already underway to build more quantum-resistant versions of asymmetric encryption.
Symmetric encryption will not be impacted nearly as much by quantum computing. While quantum computing is likely to take a bite out of symmetric encryption algorithms, increasing the key size will again give symmetric encryption enough runway and defensibility.
Quantum computing is poised to render current cryptography techniques obsolete. In fact, there is near scientific consensus that quantum computers will be able to break widely used public-key cryptographic schemes such as RSA and Diffie-Hellman. Furthermore, the transition to new quantum resistant cryptographic algorithms will take years.
Thankfully we have a head start. Not only are researchers developing new, quantum resistant encryption methodologies, some already exist. Lattice-based, code-based, hash-based, isogeny-based, and multivariate systems are all examples of quantum-resistant PKC systems.
Now that we have a clearer understanding of what data encryption means for you, let’s get into some of the development in cryptography we’re most excited for in the future.
Quantum cryptography uses photons of light and the principles of quantum physics to physically move data between a sender and recipient. Because information is transmitted using light, it cannot be intercepted, copied, or cloned. With the help of quantum mechanics, it can be sent so that only the intended recipient is able to read it without the data being altered. No additional level of encryption would be necessary because the data would be useless if it were to be intercepted by anyone other than the recipient.
Honey encryption is a bit of a misnomer in that it doesn’t rely on traditional encryption approaches. Instead, it deters cybercriminals by making them think they’ve gained access to your network or data when, in reality, they have only obtained false or irrelevant data.
We’re already beginning to witness the foundations being laid for facial encryption. As facial recognition technology advances, we expect to see facial encryption become a fundamental way of securing data and protecting access to confidential information.
Traditional encryption approaches create a point of vulnerability when you encrypt a message and again when you decrypt it even with a private key. Unfortunately, we have to decode data in order to access and use it. Homomorphic encryption seeks to tackle this problem by allowing you to use and access encrypted data without ever having to decrypt it in the first place.
If your business is ready to take your data security and encryption methodologies to the next level, contact us today.
Source: thenextweb.com
The NSA building ===>