Cryptography is the art of disguising data to keep it secure. I’m intentionally calling it an art because, when implemented correctly, it does a beautiful job of protecting valuable information.
The alternative is to store data in plaintext – a reckless and negligent strategy. Take, for example, the time Marriott exposed 5 million unencrypted passport numbers.
In this blog, I’ll decipher three pillars of cryptography and explain how each one helps you keep customer data safe.
Encryption Explained
First, why does encryption matter?
Well, if you want to communicate privately with another party, then encryption is for you.
To safely transfer information, encryption requires an algorithm (known as a cipher) and a key.
During encryption, a math equation is performed on your message to disguise it as unrecognizable characters. That equation requires the combination of the key and cipher. Afterward, if you have the key and know the algorithm to use, you can reverse the process to return the original text.
There are many encryption algorithms. And while the recommended algorithms will continue to change over time, there are two concepts you should absolutely be familiar with: symmetric vs. asymmetric encryption.
How does symmetric encryption work?
As the name implies, symmetric encryption means that ciphertext looks the same regardless of which party performed the encryption. Both parties must use the same key for this to be possible.
The shared key allows for faster encryption and decryption by both parties. Due to the speed advantage, symmetric encryption is typical for:
- Web traffic (TLS/SSL)
- Data storage
- File or database encryption
- Password protection
Because anyone with the key can decipher messages, the key must remain a secret. Trust between parties is critical here. One method for creating a shared key is the Diffie-Hellman Key Exchange – but be warned, you may get sucked down a mathematical rabbit hole.
How does asymmetric encryption work?
Asymmetric encryption uses one key to encrypt a message and an entirely separate key to decrypt the message. These are known as the ‘public’ and ‘private’ keys.
The asymmetric process is slower, so it’s reserved for identity-confirming situations like:
- Digital signatures
- Secure email
- Blockchain
Here’s how it works: Party number one delivers its public key to party number two – some entity that wishes to communicate. Party one uses its private key for encryption and decryption, while party two uses the public key.
Sound confusing?
It is. Asymmetric encryption relies on a mathematical relationship between the keys. It’s infeasible for outside parties to guess what the private key contains, so you can widely distribute a public key without the risk of data compromise.
It’s easy to get lost in the math, but here’s the best explanation I’ve found from an engineer at Google.
Want to learn more about Encryption? Check out our breakdown of how hackers steal unencrypted data.
Tokenization Explained
If you’re storing sensitive data where each value is infrequently accessed, then tokenization is for you.
Tokenization is the process of replacing important data with meaningless mock data. That fake data acts as a receipt for the valuable data (a “token,” if you will). You can get the original data back by swapping in the token at the vault.
Tokens are common when you don’t want to risk someone finding your key and decrypting your data, such as:
- Credit card storage for PCI-DSS compliance
- Social security (or other identification) numbers
- Healthcare or medical information classified as PHI
Depending on the scale and quantity of your data, using truly random mock values may be infeasible. Cryptographic tokenization is a possible solution. An easy way to think about cryptographic tokenization is creating a disguised value that you can pass around a system that only one (or few) entities know how to decrypt.
Hashing Explained
With hashing, you convert a value to a nearly-meaningless value. And it serves a beautiful purpose.
Hashing allows you to confidently confirm data matches without storing sensitive information. It’s standard practice for:
- Validating passwords without needing access to the actual string.
- Confirmation that data doesn’t change during transmission.
To get slightly further into the weeds, here’s an example of how hashing helps secure passwords:
- A new user’s password goes through a hashing function, and the output saves to a database.
- Each time the user logs in, their submitted string goes through the same hashing function.
- The user logs in if the two hash values match.
By storing hashed values rather than passwords, any attacker that breaks into the database will not have access to the raw passwords.
Modern algorithms are vital when hashing. Bad actors can look up the hashed values with a dictionary if you use outdated algorithms.
Ready to Learn More?
Today, we covered three crucial cryptographic concepts that software teams must understand. If you want further elaboration, watch my glassboard video.
Want to learn more about Application Security Posture Management? Read our latest [ungated] eBook breaking down ASPM.