Know and understand encryption including its purpose for the protection of data on hard discs, email, cloud, HTTPS websites

Safety and Security – Encryption

What is Encryption?

Encryption is the process of converting readable data (plaintext) into an unreadable form (ciphertext) using an algorithm and a key. Only someone who possesses the correct key can reverse the process (decrypt) and recover the original information.

Why Encrypt Data?

• Confidentiality – prevents unauthorised persons from reading the data.
• Integrity – when combined with hashing, ensures data has not been altered.
• Authentication – verifies the identity of the sender/receiver.
• Compliance – meets legal and organisational data‑protection requirements.

Common Encryption Types

Encryption in Different ICT Contexts

Hard‑Disk (Full‑Disk Encryption)

Full‑disk encryption (FDE) encrypts every sector of a storage device. The key is usually derived from a user password or a hardware TPM module.

1. Data is encrypted when written to the disk.
2. When the system boots, the correct key must be supplied before the OS can read the data.
3. Protects data if the device is lost or stolen.

Email Encryption

Email can be protected using:

• PGP / OpenPGP – combines symmetric encryption for the message body with asymmetric encryption for the session key.
• S/MIME – uses X.509 certificates to encrypt and digitally sign messages.

Typical workflow:

1. Sender generates a random session key.
2. Message is encrypted with the session key (symmetric).
3. Session key is encrypted with the recipient’s public key (asymmetric).
4. Recipient uses their private key to recover the session key and decrypt the message.

Cloud Storage Encryption

Data stored in the cloud is usually encrypted in two stages:

• At‑rest encryption – data is encrypted on the server using a symmetric key managed by the provider or the user.
• In‑transit encryption – data is protected while travelling between the client and the server using TLS/HTTPS.

Best practice: use client‑side encryption so that only the user holds the decryption key.

HTTPS Websites (TLS/SSL)

HTTPS secures web traffic using the Transport Layer Security (TLS) protocol. The process involves:

1. Client sends a “ClientHello” with supported cipher suites.
2. Server replies with “ServerHello”, selects a cipher suite, and sends its digital certificate.
3. Client validates the certificate (issued by a trusted CA).
4. Both parties perform a key‑exchange (e.g., Diffie‑Hellman or RSA) to create a shared symmetric session key.
5. All subsequent data is encrypted with the session key using a symmetric algorithm (often AES).

Key Management Essentials

• Never store encryption keys in the same location as the encrypted data.
• Use strong, random keys – avoid passwords or predictable patterns.
• Rotate keys regularly and retire old keys securely.
• Backup keys in a secure, offline location (e.g., hardware token, encrypted USB).

Summary Checklist for Students

1. Define encryption, plaintext, ciphertext, and key.
2. Explain why encryption is needed for confidentiality, integrity, authentication, and compliance.
3. Identify the main types of encryption (symmetric, asymmetric, hash) and give an example of each.
4. Describe how encryption protects data on hard discs, email, cloud services, and HTTPS websites.
5. List at least three best practices for key management.