by Top Ten Reviews Contributor

Encryption can protect your consumer information, emails and other sensitive data as well as secure network connections. Today, there are many options to choose from, and finding one that is both secure and fits your needs is a must. Here are four encryption methods and what you should know about each one.

AES

The Advanced Encryption Standard, AES, is a symmetric encryption algorithm and one of the most secure. The United States Government use it to protect classified information, and many software and hardware products use it as well. This method uses a block cipher, which encrypts data one fixed-size block at a time, unlike other types of encryption, such as stream ciphers, which encrypt data bit by bit.

AES is comprised of AES-128, AES-192 and AES-256. The key bit you choose encrypts and decrypts blocks in 128 bits, 192 bits and so on. There are different rounds for each bit key. A round is the process of turning plaintext into cipher text. For 128-bit, there are 10 rounds; 192-bit has 12 rounds; and 256-bit has 14 rounds.

Since AES is a symmetric key encryption, you must share the key with other individuals for them to access the encrypted data. Furthermore, if you dont have a secure way to share that key and unauthorized individuals gain access to it, they can decrypt everything encrypted with that specific key.

3DES

Triple Data Encryption Standard, or 3DES, is a current standard, and it is a block cipher. Its similar to the older method of encryption, Data Encryption Standard, which uses 56-bit keys. However, 3DES is a symmetric-key encryption that uses three individual 56-bit keys. It encrypts data three times, meaning your 56-bit key becomes a 168-bit key.

Unfortunately, since it encrypts data three times, this method is much slower than others. Also, because 3DES uses shorter block lengths, it is easier to decrypt and leak data. However, many financial institutions and businesses in numerous other industries use this encryption method to keep information secure. As more robust encryption methods emerge, this one is being slowly phased out.

Twofish

Twofish is a symmetric block cipher based on an earlier block cipher Blowfish. Twofish has a block size of 128-bits to 256 bits, and it works well on smaller CPUs and hardware. Similar to AES, it implements rounds of encryption to turn plaintext into cipher text. However, the number of rounds doesnt vary as with AES; no matter the key size, there are always 16 rounds.

In addition, this method provides plenty of flexibility. You can choose for the key setup to be slow but the encryption process to be quick or vice versa. Furthermore, this form of encryption is unpatented and license free, so you can use it without restrictions.

RSA

This asymmetric algorithm is named after Ron Rivest, Adi Shamir and Len Adelman. It uses public-key cryptography to share data over an insecure network. There are two keys: one public and one private. The public key is just as the name suggests: public. Anyone can access it. However, the private key must be confidential. When using RSA cryptography, you need both keys to encrypt and decrypt a message. You use one key to encrypt your data and the other to decrypt it.

According to Search Security, RSA is secure because it factors large integers that are the product of two large prime numbers. Additionally, the key size is large, which increases the security. Most RSA keys are 1024-bits and 2048-bits long. However, the longer key size does mean its slower than other encryption methods.

While there are many additional encryption methods available, knowing about and using the most secure ones ensures your confidential data stays secure and away from unwanted eyes.

Link:
Which Types of Encryption are Most Secure?

Email encryption is encryption of email messages to protect the content from being read by entities other than the intended recipients. Email encryption may also include authentication.

Email is prone to disclosure of information. Most emails are currently transmitted in the clear (not encrypted) form. By means of some available tools, persons other than the designated recipients can read the email contents.[1]

Email encryption can rely on public-key cryptography, in which users can each publish a public key that others can use to encrypt messages to them, while keeping secret a private key they can use to decrypt such messages or to digitally encrypt and sign messages they send.

With the original design of email protocol, the communication between email servers was plain text, which posed a huge security risk. Over the years, various mechanisms have been proposed to encrypt the communication between email servers. Encryption may occur at the transport level (aka "hop by hop") or end-to-end. Transport layer encryption is often easier to set up and use; end-to-end encryption provides stronger defenses, but can be more difficult to set up and use.

One of the most commonly used email encryption extensions is STARTTLS . It is a TLS (SSL) layer over the plaintext communication, allowing email servers to upgrade their plaintext communication to encrypted communication. Assuming that the email servers on both the sender and the recipient side support encrypted communication, an eavesdropper snooping on the communication between the mail servers cannot use a sniffer to see the email contents. Similar STARTTLS extensions exist for the communication between an email client and the email server (see IMAP4 and POP3, as stated by RFC 2595). STARTTLS may be used regardless of whether the email's contents are encrypted using another protocol.

The encrypted message is revealed to, and can be altered by, intermediate email relays. In other words, the encryption takes place between individual SMTP relays, not between the sender and the recipient. This has both good and bad consequences. A key positive trait of transport layer encryption is that users do not need to do or change anything; the encryption automatically occurs when they send email. In addition, since receiving organizations can decrypt the email without cooperation of the end user, receiving organizations can run virus scanners and spam filters before delivering the email to the recipient. However, it also means that the receiving organization and anyone who breaks into that organization's email system (unless further steps are taken) can easily read or modify the email. If the receiving organization is considered a threat, then end-to-end encryption is necessary.

The Electronic Frontier Foundation encourages the use of STARTTLS, and has launched the 'STARTTLS Everywhere' initiative to "make it simple and easy for everyone to help ensure their communications (over email) arent vulnerable to mass surveillance."[2] Support for STARTTLS has become quite common; Google reports that on GMail 90% of incoming email and 90% of outgoing email was encrypted using STARTTLS by 2018-07-24.[3]

Mandatory certificate verification is historically not viable for Internet mail delivery without additional information, because many certificates are not verifiable and few want email delivery to fail in that case.[4] As a result, most email that is delivered over TLS uses only opportunistic encryption. DANE is a proposed standard that makes an incremental transition to verified encryption for Internet mail delivery possible.[5] The STARTTLS Everywhere project uses an alternative approach: they support a preload list of email servers that have promised to support STARTTLS, which can help detect and prevent downgrade attacks.

In end-to-end encryption, the data is encrypted and decrypted only at the end points. In other words, an email sent with end-to-end encryption would be encrypted at the source, unreadable to service providers like Gmail in transit, and then decrypted at its endpoint. Crucially, the email would only be decrypted for the end user on their computer and would remain in encrypted, unreadable form to an email service like Gmail, which wouldn't have the keys available to decrypt it.[6] Some email services integrate end-to-end encryption automatically.

Notable protocols for end-to-end email encryption include:

OpenPGP is a data encryption standard that allows end-users to encrypt the email contents. There are various software and email-client plugins that allow users to encrypt the message using the recipient's public key before sending it. At its core, OpenPGP uses a Public Key Cryptography scheme where each email address is associated with a public/private key pair.

OpenPGP provides a way for the end users to encrypt the email without any support from the server and be sure that only the intended recipient can read it. However, there are usability issues with OpenPGP it requires users to set up public/private key pairs and make the public keys available widely. Also, it protects only the content of the email, and not metadata an untrusted party can still observe who sent an email to whom. A general downside of end to end encryption schemeswhere the server does not have decryption keysis that it makes server side search almost impossible, thus impacting usability.

The Signed and Encrypted Email Over The Internet demonstration has shown that organizations can collaborate effectively using secure email. Previous barriers to adoption were overcome, including the use of a PKI bridge to provide a scalable public key infrastructure (PKI) and the use of network security guards checking encrypted content passing in and out of corporate network boundaries to avoid encryption being used to hide malware introduction and information leakage.

Transport layer encryption using STARTTLS must be set up by the receiving organization. This is typically straightforward; a valid certificate must be obtained and STARTTLS must be enabled on the receiving organization's email server. To prevent downgrade attacks organizations can send their domain to the 'STARTTLS Policy List'[7]

Most full-featured email clients provide native support for S/MIME secure email (digital signing and message encryption using certificates). Other encryption options include PGP and GNU Privacy Guard (GnuPG). Free and commercial software (desktop application, webmail and add-ons) are available as well.[8]

While PGP can protect messages, it can also be hard to use in the correct way. Researchers at Carnegie Mellon University published a paper in 1999 showing that most people couldn't figure out how to sign and encrypt messages using the current version of PGP.[9] Eight years later, another group of Carnegie Mellon researchers published a follow-up paper saying that, although a newer version of PGP made it easy to decrypt messages, most people still struggled with encrypting and signing messages, finding and verifying other people's public encryption keys, and sharing their own keys.[10]

Because encryption can be difficult for users, security and compliance managers at companies and government agencies automate the process for employees and executives by using encryption appliances and services that automate encryption. Instead of relying on voluntary co-operation, automated encryption, based on defined policies, takes the decision and the process out of the users' hands. Emails are routed through a gateway appliance that has been configured to ensure compliance with regulatory and security policies. Emails that require it are automatically encrypted and sent.[11]

If the recipient works at an organization that uses the same encryption gateway appliance, emails are automatically decrypted, making the process transparent to the user. Recipients who are not behind an encryption gateway then need to take an extra step, either procuring the public key, or logging into an online portal to retrieve the message.[11][12]

Here is the original post:
Email encryption - Wikipedia

Hardware accelerated memory encryption for data-in-use protection. Takes advantage of new security components available in AMD EPYC processors

AMD Secure Memory Encryption (SME)

Uses a single key to encrypt system memory. The key is generated by the AMD Secure Processor at boot. SME requires enablement in the system BIOS or operating system. When enabled in the BIOS, memory encryption is transparent and can be run with any operating system.

AMD Secure Encrypted Virtualization (SEV)

Uses one key per virtual machine to isolate guests and the hypervisor from one another. The keys are managed by the AMD Secure Processor. SEV requires enablement in the guest operating system and hypervisor. The guest changes allow the VM to indicate which pages in memory should be encrypted. The hypervisor changes use hardware virtualization instructions and communication with the AMD Secure processor to manage the appropriate keys in the memory controller.

AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES)

Encrypts all CPU register contents when a VM stops running. This prevents the leakage of information in CPU registers to components like the hypervisor, and can even detect malicious modifications to a CPU register state.

Continue reading here:
AMD Secure Encrypted Virtualization (SEV) - AMD

HS256 HMAC using SHA-256 alg Required [IESG] [RFC7518, Section 3.2] n/a HS384 HMAC using SHA-384 alg Optional [IESG] [RFC7518, Section 3.2] n/a HS512 HMAC using SHA-512 alg Optional [IESG] [RFC7518, Section 3.2] n/a RS256 RSASSA-PKCS1-v1_5 using SHA-256 alg Recommended [IESG] [RFC7518, Section 3.3] n/a RS384 RSASSA-PKCS1-v1_5 using SHA-384 alg Optional [IESG] [RFC7518, Section 3.3] n/a RS512 RSASSA-PKCS1-v1_5 using SHA-512 alg Optional [IESG] [RFC7518, Section 3.3] n/a ES256 ECDSA using P-256 and SHA-256 alg Recommended+ [IESG] [RFC7518, Section 3.4] n/a ES384 ECDSA using P-384 and SHA-384 alg Optional [IESG] [RFC7518, Section 3.4] n/a ES512 ECDSA using P-521 and SHA-512 alg Optional [IESG] [RFC7518, Section 3.4] n/a PS256 RSASSA-PSS using SHA-256 and MGF1 with SHA-256 alg Optional [IESG] [RFC7518, Section 3.5] n/a PS384 RSASSA-PSS using SHA-384 and MGF1 with SHA-384 alg Optional [IESG] [RFC7518, Section 3.5] n/a PS512 RSASSA-PSS using SHA-512 and MGF1 with SHA-512 alg Optional [IESG] [RFC7518, Section 3.5] n/a none No digital signature or MAC performed alg Optional [IESG] [RFC7518, Section 3.6] n/a RSA1_5 RSAES-PKCS1-v1_5 alg Recommended- [IESG] [RFC7518, Section 4.2] n/a RSA-OAEP RSAES OAEP using default parameters alg Recommended+ [IESG] [RFC7518, Section 4.3] n/a RSA-OAEP-256 RSAES OAEP using SHA-256 and MGF1 with SHA-256 alg Optional [IESG] [RFC7518, Section 4.3] n/a A128KW AES Key Wrap using 128-bit key alg Recommended [IESG] [RFC7518, Section 4.4] n/a A192KW AES Key Wrap using 192-bit key alg Optional [IESG] [RFC7518, Section 4.4] n/a A256KW AES Key Wrap using 256-bit key alg Recommended [IESG] [RFC7518, Section 4.4] n/a dir Direct use of a shared symmetric key alg Recommended [IESG] [RFC7518, Section 4.5] n/a ECDH-ES ECDH-ES using Concat KDF alg Recommended+ [IESG] [RFC7518, Section 4.6] n/a ECDH-ES+A128KW ECDH-ES using Concat KDF and "A128KW" wrapping alg Recommended [IESG] [RFC7518, Section 4.6] n/a ECDH-ES+A192KW ECDH-ES using Concat KDF and "A192KW" wrapping alg Optional [IESG] [RFC7518, Section 4.6] n/a ECDH-ES+A256KW ECDH-ES using Concat KDF and "A256KW" wrapping alg Recommended [IESG] [RFC7518, Section 4.6] n/a A128GCMKW Key wrapping with AES GCM using 128-bit key alg Optional [IESG] [RFC7518, Section 4.7] n/a A192GCMKW Key wrapping with AES GCM using 192-bit key alg Optional [IESG] [RFC7518, Section 4.7] n/a A256GCMKW Key wrapping with AES GCM using 256-bit key alg Optional [IESG] [RFC7518, Section 4.7] n/a PBES2-HS256+A128KW PBES2 with HMAC SHA-256 and "A128KW" wrapping alg Optional [IESG] [RFC7518, Section 4.8] n/a PBES2-HS384+A192KW PBES2 with HMAC SHA-384 and "A192KW" wrapping alg Optional [IESG] [RFC7518, Section 4.8] n/a PBES2-HS512+A256KW PBES2 with HMAC SHA-512 and "A256KW" wrapping alg Optional [IESG] [RFC7518, Section 4.8] n/a A128CBC-HS256 AES_128_CBC_HMAC_SHA_256 authenticated encryption algorithm enc Required [IESG] [RFC7518, Section 5.2.3] n/a A192CBC-HS384 AES_192_CBC_HMAC_SHA_384 authenticated encryption algorithm enc Optional [IESG] [RFC7518, Section 5.2.4] n/a A256CBC-HS512 AES_256_CBC_HMAC_SHA_512 authenticated encryption algorithm enc Required [IESG] [RFC7518, Section 5.2.5] n/a A128GCM AES GCM using 128-bit key enc Recommended [IESG] [RFC7518, Section 5.3] n/a A192GCM AES GCM using 192-bit key enc Optional [IESG] [RFC7518, Section 5.3] n/a A256GCM AES GCM using 256-bit key enc Recommended [IESG] [RFC7518, Section 5.3] n/a EdDSA EdDSA signature algorithms alg Optional [IESG] [RFC8037, Section 3.1] [RFC8032] RS1 RSASSA-PKCS1-v1_5 with SHA-1 JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms] RSA-OAEP-384 RSA-OAEP using SHA-384 and MGF1 with SHA-384 alg Optional [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] n/a RSA-OAEP-512 RSA-OAEP using SHA-512 and MGF1 with SHA-512 alg Optional [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] n/a A128CBC AES CBC using 128 bit key JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms] A192CBC AES CBC using 192 bit key JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms] A256CBC AES CBC using 256 bit key JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms] A128CTR AES CTR using 128 bit key JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms] A192CTR AES CTR using 192 bit key JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms] A256CTR AES CTR using 256 bit key JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms] HS1 HMAC using SHA-1 JWK Prohibited [W3C_Web_Cryptography_Working_Group] [https://www.w3.org/TR/WebCryptoAPI] [draft-irtf-cfrg-webcrypto-algorithms]

Excerpt from:
JSON Object Signing and Encryption (JOSE)

In an effort led by CEO Mark Zuckerberg, Facebook has plans to rearchitect WhatsApp, Instagram direct messages, and Facebook Messenger so that messages can travel across any of the platforms. The New York Times first reported the move Friday, noting also that Zuckerberg wants the initiative to "incorporate end-to-end encryption." Melding those infrastructures would be a massive task regardless, but designing the scheme to universally preserve end-to-end encryptionin a way that users understandposes a whole additional set of critical challenges.

As things stand now, WhatsApp chats are end-to-end encrypted by default, while Facebook Messenger only offers the feature if you turn on "Secret Conversations." Instagram does not currently offer any form of end-to-end encryption for its chats. WhatsApp's move to add default encryption for all users was a watershed moment in 2016, bringing the protection to a billion people by flipping one switch.

Facebook is still in the early planning stages of homogenizing its messaging platforms, a move that could increase the ease and number of secured chats online by a staggering order of magnitude. But cryptographers and privacy advocates have already raised a number of obvious hurdles the company faces in doing so. End-to-end encrypted chat protocols ensure that data is only decrypted and intelligible on the devices of the sender and recipient. At least, that's the idea. In practice, it can be difficult to use the protection effectively if it's enabled for some chats and not for others and can turn on and off within a chat at different times. In attempting to unify its chat services, Facebook will need to find a way to help users easily understand and control end-to-end encryption as the ecosystem becomes more porous.

"The big problem I see is that only WhatsApp has default end-to-end encryption," says Matthew Green, a cryptographer at Johns Hopkins. "So if the goal is to allow cross-app traffic, and its not required to be encrypted, then what happens? There are a whole range of outcomes here."

WhatsApp users, for example, can assume that all of their chats are end-to-end encrypted, but what will happen in Facebook's newly homogenized platform if an Instagram user messages a WhatsApp user? It's unclear what sort of defaults Facebook will impose, and how it will let users know whether their chats are encrypted.

Facebook can also glean more data from unencrypted chats and introduce monetizable experiences like bots into them. The company has had a notoriously hard time earning revenue off of WhatsApp's 1.5 billion users, in part because of end-to-end encryption.

"We want to build the best messaging experiences we can; and people want messaging to be fast, simple, reliable and private," a Facebook spokesperson said in a statement on Friday. "We're working on making more of our messaging products end-to-end encrypted and considering ways to make it easier to reach friends and family across networks. As you would expect, there is a lot of discussion and debate as we begin the long process of figuring out all the details of how this will work."

Facebook emphasizes that this gradual process will allow it to work out all the kinks before debuting a monolithic chat structure. But encryption's not the only area of concern. Privacy advocates are concerned about the potential creation of a unified identity for people across all three services, so that messages go to the right place. Such a setup could be convenient in many ways, but it could also have complicated ramifications.

In 2016, WhatsApp started sharing user phone numbers and other analytics with Facebook, perforating what had previously been a red line between the two services. WhatsApp still lets users make an account with only a phone number, while Facebook requires your legal name under its controversial "real name" policy. The company maintains this rule to prevent confusion and fraud, but its rigidity has caused problems for users who have other safety and security reasons for avoiding their legal or given name, such as being transgender.

"If the goal is to allow cross-app traffic, and its not required to be encrypted, then what happens?"

Matthew Green, Johns Hopkins University

In a Wall Street Journal opinion piece on Thursday evening, Zuckerberg wrote that, "Theres no question that we collect some information for adsbut that information is generally important for security and operating our services as well." An indelible identity across Facebook's brands could have security benefits like enabling stronger anti-fraud protections. But it could also unlock an even richer and more nuanced user data trove for Facebook to mine, and potentially make it harder to use one or more of the services without tying those profiles to a central identity.

"The obvious identity issue is usernames. I'm one thing on Facebook and another on Instagram," says Jim Fenton, an independent identity privacy and security consultant. "In some ways, having the three linked more closely together would be good because it would make it more transparent that they are connected. But there are some Instagram and WhatsApp users who don't want to use Facebook. This might be seen as a way to try to push more people in."

Such a change to how chat works on the three brands isn't just a potentially massive shift for usersit also seems to have stirred deep controversy within Facebook itself, and may have contributed to the departure last year of WhatsApp cofounders Jan Koum and Brian Acton.

End-to-end encryption is also difficult to implement correctly, because any oversight or bug can undermine the whole scheme. For example, both WhatsApp and Facebook Messenger currently use the open-source Signal protocol (used in the Signal encrypted messaging app), but the implementations are different, because one service has the encryption on by default and the other doesn't. Melding these different approaches could create opportunities for error.

"Theres a world where Facebook Messenger and Instagram get upgraded to the default encryption of WhatsApp, but that probably isn't happening," Johns Hopkins' Green says. "Its too technically challenging and would cost Facebook access to lots of data."

And while end-to-end encryption can't solve every privacy issue for everyone all the time anyway, it's harder to know how to take advantage of it safely when a service doesn't offer it consistently, and creates potential privacy issues when it centralizes identities.

"I think they can work this out," Fenton says. "The bigger problem in my opinion is user confusion."

See original here:
The Pitfalls of Facebook Merging Messenger, Instagram, and ...

What is encryption?

Encryption is a mathematical function using a secret valuethe keywhich encodes data so that only users with access to that key can read the information. In many cases encryption can provide an appropriate safeguard against the unauthorised or unlawful processing of personal data, especially in cases where it is not possible to implement alternative measures.

Example

An organisation issues laptops to employees for remote working together with secure storage lockers for use at home and locking devices for use outside the home. However, there is still the risk of loss or theft of the devices (eg whilst being used outside of the office). To address this risk, the organisation requires all data stored on laptops to be encrypted. This significantly reduces the chance of unauthorised or unlawful processing of the data in the event of loss or theft.

Information is encrypted and decrypted using a secret key. (Some algorithms use a different key for encryption and decryption). Without the key the information cannot be accessed and is therefore protected from unauthorised or unlawful processing.

Whilst it is possible to attempt decryption without the key (eg, by trying every possible key in turn), in practical terms it will take such a long time to find the right keyie many millions of years, depending on the computing power available and the type of keythat it becomes effectively impossible. However, as computing power increases, the length of time taken to try a large number of keys will reduce so it is important that you keep algorithms and key sizes under consideration, normally by establishing a review period.

You should consider encryption alongside a range of other technical and organisational security measures. You also need to ensure that your use of encryption is effective against the risks you are trying to address, as it cannot be used in every processing operation.

Therefore, you should consider the benefits that encryption will offer in the context of your processing, as well as the residual risks. You should also consider whether there are other security measures that may be appropriate to put in place, either instead of encryption or alongside it.

You can do this by means of a Data Protection Impact Assessment (DPIA), which, depending on your processing activities, you may be required to undertake under Article 35 of the GDPR. In any case, a DPIA will also help you to assess your processing, document any decisions and the reasons for them, and can ensure that you are only using the minimum personal data necessary for the purpose.

In more detail European Data Protection Board (EDPB)

The EDPB, formerly the Article 29 Working Party, includes representatives from the data protection authorities of each EU member state. It adopts guidelines for complying with the requirements of the GDPR.

In October 2017, Article 29 published guidelines on DPIAs and high-risk processing under the GDPR (WP248rev01). The EDPB formally endorsed these guidelines on 25 May 2018.

Yes. Article 4(2) of the GDPR defines processing as any operation or set of operations performed on personal data, including adaptation or alteration.

The process of converting personal data from plaintext into ciphertext represents adaptation or alteration of that data. Whether you are a controller or a processor, if you have encrypted personal data yourself and are responsible for managing the key then you will still be processing data covered by the GDPR.

If you also subsequently store, retrieve, consult or otherwise use that encrypted data, you will also be processing data covered by the GDPR.

You should therefore ensure that you do not view the use of encryption as an anonymisation technique or think the encrypted data is not subject to the GDPR. If you were responsible for encrypting the data and are the holder of the key, you have the ability to re-identify individuals through decryption of that dataset.

In this respect, encryption can be regarded as a pseudonymisation technique. It is a security practice designed to safeguard personal data.

You should not underestimate the importance of good key management - make sure that you keep the keys secret in order for encryption to be effective.

Encryption can take many different forms. Whilst it is not the intention to review each of these in turn, it is important to recognise when and where encryption can provide protection to certain types of data processing activities. Later in this guidance, we outline a number of scenarios where encryption may be beneficial to you.Encryption is also governed by laws and regulations, which may differ by country. For example, in the UK you may be required to provide access to the key in the event you receive a court order to do so.

Finally, not all processing activities can be completely protected from end to end using encryption. This is because at present information needs to exist in a plaintext form whilst being actively processed. For example, data contained within a spreadsheet can be stored in an encrypted format but in order for the spreadsheet software to open it and the user to analyse it, that data must first be decrypted. The same is true for information sent over the internet it can be encrypted whilst it is in transit but must be decrypted in order for the recipient to read the information.

When processing data, there are a number of areas that can benefit from the use of encryption. You should assess the benefits and risks of using encryption at these different points in the processing lifecycle separately. When first considering your processing, you should also ensure that you adopt a data protection by design approach, and using encryption can be one example of the measures that you put in place as part of this approach.

The two main purposes for which you should consider using encryption are data storage and data transfer. These two activities can also be referred to as data at rest and data in transit.

Recommendation

You should have a policy governing the use of encryption, including guidelines that enable staff to understand when they should and should not use it.

For example, there may be a guideline stating that any email containing sensitive personal data (either in the body or within an attachment) should be sent encrypted or that all mobile devices should be encrypted and secured with a password complying with a specific format.

You should also be aware of any industry or sector-specific guidelines that may include a minimum standard or recommend a specific policy for encrypting personal data. Examples include:

Read more from the original source:
What is encryption? | ICO

My teenage daughter wanted to play, so we went as a family on vacation. My younger child is 11, but everyone was able to participate in solving the game. Because of his size, my son found a number of the clues placed lower down. We thought it was a great facility with a super atmosphere and friendly staff. Even my husband had a blast, and he had thought it was going to be boring!

Denna E.

Doylestown, OH

I didnt know what to expect and was actually afraid I might get creeped out, but it was not scary at all. It was the exact opposite; we never stopped laughing from the time we got in there. I would never have thought we could have so much fun in an hour. I cant wait to try another one of their game rooms. I can see how this could become addicting!

Stephanie R.

Savannah, GA

If youve always wanted to be a CSI, this is the place for you! It was like a real life version of a video game very clever! We had so much fun figuring out the clues and are still talking about it! I would definitely recommend this place, if youre looking for a great group activity or if you love a challenge, but make sure you ask for clues cause youll need them!

Susan G.

Ontario, Canada

The best one Ive ever been to super challenging and well worth going! I tell everybody what a good time it was.

Shawn G.

Houston, TX

I went with my wife and friends. We had never done anything like this before so we had no idea what to expect, but we had a great time! Everything was really well thought out. It was definitely worth the money because we had a lot of fun, and everyone was super helpful. By the time we left, we were already talking about when we could go back again and told tourists we talked to at dinner that they should check it out!

Alex M.

Jesup, GA

Glad we tried this. Seems like we always do the same old things on vacation, but this was a heck of lot more exciting than goofy golf!

Scott J.

Vero Beach, FL

Follow this link:
Encryption Escape, A Real Escape Game - Savannah

Please fill out the following fields:

CountryUnited StatesCanadaIndiaAfghanistanAlbaniaAlgeriaAmerican SamoaAndorraAngolaAnguillaAntarcticaAntigua and BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBoliviaBosnia and HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean Trty.Brunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCape VerdeCayman IslandsCentral African RepublicChadChileChinaChristmas IslandCocos (Keeling) IslandsColombiaComorosCongoCook IslandsCosta RicaCote D'IvoireCroatiaCubaCyprusCzech RepublicDenmarkDjiboutiDominicaDominican RepublicEast TimorEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe IslandsFijiFinlandFranceFrance, MetropolitanFrench GuianaFrench PolynesiaFrench Southern TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuineaGuinea-BissauGuyanaHaitiHondurasHong KongHungaryIcelandIndonesiaIran (Islamic Republic of)IraqIrelandIsraelItalyJamaicaJapanJordanKazakhstanKenyaKiribatiKoreaKorea (Democratic)KuwaitKyrgystanLaosLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMacauMacedoniaMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall IslandsMartiniqueMauritaniaMauritiusMayotteMexicoMicronesiaMoldovaMonacoMongoliaMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNetherlands AntillesNeutral ZoneNew CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorthern Mariana IslandsNorwayOmanPakistanPalauPanamaPapua New GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto RicoQatarReunionRomaniaRussian FederationRwandaSaint HelenaSaint Kitts and NevisSaint LuciaSaint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSpainSri LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab RepublicTaiwanTajikistanTanzaniaThailandTogoTokelauTongaTrinidad and TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUruguayUS Minor Outlying IslandsUzbekistanVanuatuVatican City StateVenezuelaViet NamVirgin Islands (British)Virgin Islands (US)Wallis and FutunaWestern SaharaYemenYugoslaviaZaireZambiaZimbabwe

Title Level Attorney / General Counsel / Counsel AVP Board of Director C Level - Other CCO CEO / President CFO Chairperson CIO CISO / CSO COO CRO CTO Director EVP / SVP / FVP Head Healthcare Professional Manager / Supervisor Partner VP --Other Title Level--

Job Function Anti-Money Laundering (AML) Audit Business Continuity/Disaster Recovery Business Development Cashier / Customer Service / Administrative Clinical Healthcare Professional Compliance / BSA Data Management Debit/Credit Card/Electronic Banking eCommerce / eBusiness Executive Management Finance / Accounting Founder / Owner Fraud HR / Training Information Security Information Technology Legal Lending Loss Prevention Marketing Network / Systems / Web Operations Others Policies / Procedures Product Management Project Regulatory Affairs Risk Management Sales Security / Privacy Vendor Management --Other Job Function--

Subscription Preferences:

Banking

Risk Management

Data Breach

Careers

Subscribe

See the rest here:
Encryption, Key Management - bank information security

What is Encryption

Encryption is a means of securing digital data using an algorithm and a password, or key. The encryption process translates information using an algorithm that turns plain text unreadable. When an authorized user needs to read the data, they may decrypt the data using a binary key.

Encryption is an important way for individuals and companies to protect sensitive information from hacking. For example, websites that transmit credit card and bank account numbers should always encrypt this information to prevent identity theft and fraud.

Encryption strength depends on the length of the encryption security key. In the latter quarter of the 20th century, web developers used either 40 bit encryption, which is a key with 240 possible permutations, or 56 bit encryption. However, by the end of the century hackers could break those keys through brute-force attacks. This led to a 128 bit system as the standard encryption length for web browsers.

The Advanced Encryption Standard (AES) is a protocol for data encryption created in 2001 by the U.S. National Institute of Standards and Technology. AES uses a 128 bit block size, and key lengths of 128, 192 and 256 bits.

AES uses a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data. Asymmetric-key algorithms use different keys for the encryption and decryption processes.

Today, 128-bit encryption is standard but most banks, militaries and governments use 256-bit encryption.

In May of 2018, the Wall Street Journal reported that despite the importance and accessibility of encryption, many corporations still fail to encrypt sensitive data. By some estimates, companies encryped only one-third of all sensitive corporate data in 2016, leaving the remaining two thirds sensitive to theft or fraud.

Encryption makes it more difficult for a company to analyze its own data, using either standard means or artificial intelligence. Speedy data analysis can sometimes mean the difference between which of two competing companies gains a market advantage, which partly explains why companiesresist encrypting data.

Consumers should understand that encryption does not always protect data from hacking. For example, in 2013 hackers attacked Target Corporation and managed to compromise the information of up to 40 million credit cards. According to Target, the credit card information was encrypted, but the hackers sophistication still broke through the encryption. This hack was the second largest breach of its kind in U.S. history and led to an investigation by the U.S. Secret Service and the Justice Department.

Read the original here:
Encryption - Investopedia

A transition in cryptographic technologies is underway. New algorithms for encryption, authentication, digital signatures, and key exchange are needed to meet escalating security and performance requirements. Many of the algorithms that are in extensive use today cannot scale well to meet these needs. RSA signatures and DH key exchange are increasingly inefficient as security levels rise, and CBC encryption performs poorly at high data rates. An encryption system such as an IPsec Virtual Private Network uses many different component algorithms, and the level of security that it provides is limited by the lowest security level of each of those components. What we need is a complete algorithm suite in which each component provides a consistently high level of security and can scale well to high throughput and high numbers of connections. The next generation of encryption technologies meets this need by using Elliptic Curve Cryptography (ECC) to replace RSA and DH, and using Galois/Counter Mode (GCM) of the Advanced Encryption Standard (AES) block cipher for high-speed authenticated encryption. More on these algorithms below, but first, some good news: the new ISR Integrated Services Module brings these next-generation encryption (NGE) technologies to IPsec Virtual Private Networks, providing a security level of 128 bits or more. These technologies are future proof: the use of NGE enables a system to meet the security requirements of the next decade, and to interoperate with future products that leverage NGE to meet scalability requirements. NGE is based on IETF standards, and meets the government requirements for cryptography stipulated in FIPS-140.

NGE uses new crypto algorithms because they will scale better going forward. This is analogous to the way that jets replaced propeller planes; incremental improvements in propeller-driven aircraft are always possible, but it was necessary to adopt turbojets to achieve significant advances in speed and efficiency.

The community that needs a new technology most leads its adoption. For instance, the transition from propellers to jet engines happened for military applications before jets were adopted for commercial use. Similarly, governments are leading the transition to next generation encryption. The U.S. government selected and recommended a set of cryptographic standards, called Suite B because it provides a complete suite of algorithms that are designed to meet future security needs. Suite B has been approved for protecting classified information at both the SECRET and TOP SECRET levels. Suite B sets a good direction for the future of network security, and the Suite B algorithms have been incorporated into many standards. (Cisco supported the development of some of these standards, including GCM authenticated encryption and implementation methods for ECC.) NGE uses the Suite B algorithms for two different reasons. First, it enables government customers to conform to the Suite B requirements. Second, Suite B offers the best technologies for future-proof cryptography, and is setting the trend for the industry. These are the best standards that one can implement today if the goal is to meet the security and scalability requirements ten years hence, or to interoperate with the crypto that will be deployed in that timescale.

A network encryption system must meet the networks requirements for high throughput, high numbers of connections, and low latency, while providing protection against sophisticated attacks. Cryptographic algorithms and key sizes are designed to make it economically infeasible for an attacker to break a cryptosystem. In principle, all algorithms are vulnerable to an exhaustive key search. In practice, this vulnerability holds only if an attacker can afford enough computing power to try every possible key. Encryption systems are designed to make exhaustive search too costly for an attacker, while also keeping down the cost of encryption. The same is true for all of the cryptographic components that are used to secure communications digital signatures, key establishment, and cryptographic hashing are all engineered so that attackers cant afford the computing resources that would be needed to break the system.

Every year, advances in computing lower the cost of processing and storage. These advances in computing accrue over the years and make it imperative to periodically move to larger key sizes. Because of Moores law, and a similar empirical law for storage costs, symmetric cryptographic keys need to grow by a bit every 18 months. In order for an encryption system to have a useful shelf life, and be able to securely interoperate with other devices throughout its operational lifespan, it should provide security ten or more years into the future. The use of good cryptography is more important now than ever before, due to the threat of well-funded and knowledgeable attackers.

A complete crypto suite includes algorithms for authenticated encryption, digital signatures, key establishment, cryptographic hashing. I touch on each of these below, to explain the need for technology changes. The Rivest-Shamir-Adleman (RSA) algorithms for encryption and digital signatures are less efficient at higher security levels, as is the integer-based Diffie-Hellman (DH). In technical terms, there are sub-exponential attacks that can be used against these algorithms, and thus their key sizes must be substantially increased to compensate for this fact. In practice, this means that RSA and DH are becoming less efficient every year.

Elliptic Curve Cryptography (ECC) replaces RSA signatures with the ECDSA algorithm, and replaces the DH key exchange with ECDH. ECDSA is an elliptic curve variant of the DSA algorithm, which has been a standard since 1994. ECDH is an elliptic curve variant of the classic Diffie-Hellman key exchange. DH and DSA are both based on the mathematical group of integers modulo a large prime number. The ECC variants replace that group with a different mathematical group that is defined by an elliptic curve. The advantage of ECC is that there are no sub-exponential attacks that work against ECC, which means that ECC can provide higher security at lower computational cost. The efficiency gain is especially pronounced as one turns the security knob up.

The AES block cipher is widely used today; it is efficient and provides a good security level. However, the Cipher Block Chaining (CBC) mode of operation for AES, which is commonly used for encryption, contains serialized operations that make it impossible to pipeline. Additionally, it does not provide authentication, and thus the data encrypted by CBC must also be authenticated using a message authentication code like HMAC. NGE improves on the combination of CBC and HMAC by using AES in the Galois/Counter Mode (GCM) of operation.

Fifteen years ago, it was considered a truism that encryption could not keep up with the fastest networks. Ten years ago, it was realized that the counter mode of operation (CTR) could keep up, but that did not resolve the need for data authentication. GCM solves this problem by incorporating an efficient authentication method, based on arithmetic over finite fields. GCM is an authenticated encryption algorithm; it provides both confidentiality and authenticity. Combing both these security services into a single algorithm improves both security and performance. (For instance, it prevents subtle attacks that exploit unauthenticated encryption, such as the recent BEAST attack against the TLS/SSL protocol and similar attacks.) AES-GCM is efficient even at very high data rates, because its design enables the use of full data pipelines and parallelism. Its efficiency is showcased by its use in the IEEE MACsec protocol, where it has kept up with 802.1 data rates of 10, 40, and even 100 gigabits per second without adding significant latency.

NGE follows Suite B and uses the SHA-2 family of hash functions. These functions replace the ubiquitous SHA-1 hash with SHA-256, SHA-384, and SHA-512. SHA-1 only targets an 80-bit security level, and has been shown to not meet that goal. If you are still using SHA-1, you should transition to SHA-256, which provides a 128-bit security level.

For more information about Ciscos offering for faster next-generation encryption, see the Cisco VPN Internal Service Module for the ISR G2 page.

Share:

Read the original post:
Next Generation Encryption - blogs.cisco.com