Encryption & Digital Certificates

What is Encryption?

Encryption is the process of converting data into an unreadable format to prevent unauthorised access.

It ensures data confidentiality, integrity, and security during transmission or storage.

Symmetric Cryptography

What it is:

Encryption that uses one secret key for both encryption and decryption. If Ahmed and Beatrice both know the same key K, either can encrypt with K and the other can decrypt with K.

Common algorithms:

AES (e.g. AES-GCM, AES-CBC), ChaCha20.

Pre-shared key (PSK) message:

  1. Agree key: Ahmed and Beatrice meet in person and agree a secret key K.
  2. Encrypt: Ahmed encrypts his message with AES-GCM using K. Output: ciphertext + an authentication tag.
  3. Send: He emails the ciphertext (the key is not sent).
  4. Decrypt: Beatrice uses the same K to decrypt. The authentication tag proves the message wasn’t altered.
  5. Result: Confidential and integrity-checked message-provided the shared key stayed secret.

Fast session after a key exchange:

  1. Agree session key: Ahmed and Beatrice first use a secure key-agreement method (e.g. Diffie–Hellman or a code sent via a separate channel) to derive a fresh session key Ksession.
  2. Encrypt chat: All chat messages are then encrypted with AES-GCM under Ksession-this is fast and efficient.
  3. Rotate: They can rotate Ksession periodically for extra safety.
  4. Result: Real-time, low-latency confidentiality once a shared key exists.

Strengths:

  • Very fast; ideal for large files and real-time traffic.
  • Modern modes (e.g. GCM) also provide integrity (tamper detection).

Limitations:

  • Key distribution problem: both sides must already share the same secret key-safely.
  • One key protects everything; if it leaks, confidentiality is lost.

Asymmetric Cryptography

What it is:

Encryption that uses a key pair: a public key (shared openly) and a private key (kept secret). Data encrypted with the public key can be decrypted only with the matching private key. The private key can also create digital signatures that the public key verifies.

Common algorithms:

RSA, Elliptic-Curve (e.g. X25519 for key agreement, Ed25519 for signatures), ECDSA.

Send a confidential file to the owner of a public key:

  1. Get the key: Ahmed downloads Beatrice’s public key (or reads it from her digital certificate).
  2. Encrypt: Ahmed encrypts the file with Beatrice’s public key (typically via a hybrid method that wraps a random symmetric key).
  3. Send: He emails the ciphertext.
  4. Decrypt: Only Beatrice’s private key can decrypt the wrapped key and then the file.
  5. Result: Anyone can send to Beatrice securely; only she can read it.

Prove who sent a message (digital signature):

  1. Sign: Ahmed uses his private key to sign a message hash, creating a digital signature.
  2. Send: He sends the message + signature to Beatrice.
  3. Verify: Beatrice uses Ahmed’s public key to verify the signature matches the message.
  4. Result: Beatrice gains authenticity (it was Ahmed) and integrity (it wasn’t altered). Confidentiality is not provided by a signature alone.

Strengths:

  • No shared secret needed to start; anyone with your public key can send you a secret.
  • Enables authentication and signatures (prove identity and integrity).

Limitations:

  • Slower and heavier than symmetric crypto; usually used to exchange a symmetric session key, then switch to fast symmetric encryption.
  • Public keys must be trusted (e.g. certificates) to avoid impostors.

Where you see both (hybrid):

In HTTPS, the browser uses asymmetric crypto to authenticate the server and agree a session key, then uses symmetric crypto (e.g. AES-GCM or ChaCha20-Poly1305) for the actual data, combining authenticity with speed.

What Are Digital Certificates?

Digital certificates are electronic documents that confirm the identity of a person, organisation, or website.

They are issued by a Certificate Authority (CA) and ensure secure encryption using SSL/TLS protocols in web browsers.

How Digital Certificates Work

Stage What happens
Issuance A trusted Certificate Authority (CA) verifies the organisation/website (identity checks vary by certificate type) and issues a digital certificate that contains the subject’s public key, the subject name, validity dates, and the CA’s digital signature.
Verification The browser validates the certificate: it checks the CA chain, expiry, revocation status, and that the hostname matches (e.g. www.example.com). If all checks pass, the site is treated as authentic.
Encryption setup During the HTTPS/TLS handshake, the browser uses the certificate’s public key to establish shared session keys (key agreement). These keys are then used for fast symmetric encryption of the connection.
Authentication The server proves it controls the certificate’s private key (typically by producing a valid digital signature during the handshake). Optionally, with mutual TLS, a client certificate lets the user prove their identity in the same way.

The Importance of Encryption Key Management

  • Key Storage: Keeps encryption keys in secure, encrypted containers.
  • Access Control: Limits who can access or use the keys.
  • Regular Key Rotation: Replaces old keys periodically to reduce risk.
  • Backup and Recovery: Protects against key loss or corruption to avoid data being permanently inaccessible.

Comparison of Symmetric and Asymmetric Encryption

Feature Symmetric Encryption Asymmetric Encryption
Key Usage Same key used to encrypt and decrypt Uses a pair: public for encryption, private for decryption
Speed Faster Slower
Security Relies on secure key exchange More secure for transmitting data
Common Uses Encrypting stored files or backups Secure messaging, digital signatures

Why is Encryption Essential?

  • Protects Data: Keeps information secure during transfer and storage.
  • Ensures Privacy: Confidential data remains unreadable to unauthorised parties.
  • Enables Trust: Digital certificates confirm the identity of websites and services.
  • Prevents Cyber Threats: Reduces the risk of interception, theft, or tampering.

 Key Takeaways

  • Encryption protects data using symmetric and asymmetric methods.
  • Digital certificates verify identities and enable secure web communications.
  • Public/private keys are critical for secure data exchange.
  • Key management is essential to prevent unauthorised access to encrypted data.