Cyberstudy
PDF p.69 In progress

Encryption Supporting Confidentiality

Open PDF at p.69 20 flashcards

Summary

PDF p.69

Encryption ensures confidentiality by making data unreadable to unauthorized parties, even if intercepted or stolen. Data can be in three states: at rest, in transit, or in use. Bulk encryption uses symmetric ciphers for efficiency, while asymmetric encryption is used to securely distribute symmetric keys. A typical encryption scheme involves both symmetric and asymmetric encryption to protect data.

In plain words

Supplementary — not from your PDF

Data can be at rest (stored), in transit (moving over a network) or in use (in memory). A common design encrypts the data with a fast symmetric key (the DEK), then protects that key with the user's asymmetric key pair (the KEK).

Detailed explanation

PDF p.69
  • Confidentiality through Encryption
    • Purpose: Ensures that intercepted or stolen data cannot be understood or altered by unauthorized parties.
    • Data States
      • Data at Rest: Stored in persistent media.
      • Data in Transit: Transmitted over a network.
      • Data in Use: Present in volatile memory (RAM, CPU registers, cache).
  • Bulk Encryption
    • Definition: Encrypting large amounts of data (megabytes or gigabytes).
    • Symmetric Ciphers: Used for bulk encryption due to efficiency (e.g., AES).
    • Asymmetric Ciphers: Not efficient for bulk encryption due to high computational overhead.
  • Symmetric and Asymmetric Encryption Scheme
    • Symmetric Key Distribution: Challenging due to confidentiality concerns.
    • Combined Approach
      • 1. Asymmetric Key Pair Generation: User generates a key pair (e.g., RSA or ECC). The private key is encrypted and serves as the Key Encryption Key (KEK).
      • 2. Symmetric Key Generation: System generates a symmetric key (e.g., AES256 or AES512) for data encryption, referred to as the Data Encryption Key (DEK).
      • 3. Key Encryption: DEK is encrypted using the public key portion of the KEK.
      • 4. Data Access: User supplies a password or starts an authenticated session to use their private key to decrypt the DEK, which then decrypts the data.

Important terms

taken from the text above
Data at Rest
Stored in persistent media.
Data in Transit
Transmitted over a network.
Data in Use
Present in volatile memory (RAM, CPU registers, cache).
Bulk Encryption
Encrypting large amounts of data (megabytes or gigabytes).
Symmetric Ciphers
Used for bulk encryption due to efficiency (e.g., AES).
Asymmetric Ciphers
Not efficient for bulk encryption due to high computational overhead.
Symmetric Key Distribution
Challenging due to confidentiality concerns.
Asymmetric Key Pair Generation
User generates a key pair (e.g., RSA or ECC). The private key is encrypted and serves as the Key Encryption Key (KEK).
Symmetric Key Generation
System generates a symmetric key (e.g., AES256 or AES512) for data encryption, referred to as the Data Encryption Key (DEK).
Key Encryption
DEK is encrypted using the public key portion of the KEK.
Data Access
User supplies a password or starts an authenticated session to use their private key to decrypt the DEK, which then decrypts the data.
KEK Key Encryption Key DEK Data Encryption Key

Examples & real-world scenarios

Supplementary — not from your PDF
  • Data at rest: an encrypted database file.
  • Data in transit: HTTPS traffic.
  • Data in use: information loaded in RAM for processing.

Scenario

An encrypted file store uses AES-256 for the files (DEK). Each user's DEK access is wrapped with their key pair (KEK). Revoking a user means re-wrapping keys, not re-encrypting terabytes of files.

Common mistakes

Supplementary — not from your PDF
  • Believing the PDF's 'AES512'. The largest AES key is 256 bits.
  • Forgetting data in use. Encryption at rest and in transit doesn't protect data in memory.

Practical skills

Supplementary — not from your PDF
  • Name the data state and the matching protection in a scenario.

What I should remember

Key Points PDF p.69
  • Confidentiality through Encryption
    • Unreadable Data: Ensures data cannot be understood by unauthorized parties.
    • Data States: At rest, in transit, in use.
  • Bulk Encryption
    • Symmetric Ciphers: Efficient for large data (e.g., AES).
    • Asymmetric Ciphers: Inefficient for bulk data.
  • Symmetric and Asymmetric Encryption Scheme
    • Symmetric Key Distribution: Challenging but necessary.
    • Combined Approach
      • 1. Asymmetric Key Pair: Generates KEK.
      • 2. Symmetric Key: Generates DEK.
      • 3. Key Encryption: DEK encrypted with KEK.
      • 4. Data Access: Decrypt DEK with private key to access data.