The Role of Cryptography in Protecting Personal Data

Are you like me, struggling to get your head around terms like symmetric encryption, asymmetric encryption, public key, private key, hashing, salting, digital signatures, SSL certificates, decryption, etc.?

If yes, then you’ve come to the right place! Let’s explore each term with real-life examples in a casual way.

What Happens When You Visit a Website?

Ever wondered what’s happening behind the scenes when you visit a website?

• How do you know the data you send to the website isn’t being intercepted by unauthorized people?
• How do you know the website is legitimate?
• Is the data secure from being altered?
• How do you trust the website with your passwords?
• Can someone access your passwords from the website’s database?

To answer all these questions, you need to understand the basics of cryptography.

What is Cryptography?

Cryptography is the practice of protecting information from unauthorized access. Simply put, if Person A sends a message to Person B, only Person B should be able to read it. Even if others (like Persons C or D) intercept the message, they should not understand it. Cryptography ensures this happens.

Now that you understand cryptography, let’s break down other terms with examples!

Buying a Gift Online

Let’s say I’m trying to buy a gift for my mom’s birthday from a website I’ve never used before. I type bdaygifts.com into my browser.

When I hit enter, my browser sends a request to the server where the website is hosted.

But wait — how does my browser know the website is legitimate?

Example of SSL/TLS Certificate

Just like in real life, where people prove their identity with documents, servers prove their identity with certificates. These certificates are issued by trusted organizations called Certificate Authorities (CAs). You might have seen these certs in your url bar when you visit a https website.

But how does my browser know the CA is trustworthy? That’s where the root certificate store comes in. Your browser has a built-in list of trusted CAs and their public keys. Only certificates signed by these CAs are considered valid.

Congrats! You’ve just learned about SSL/TLS certificates!

Encryption and Decryption

I mentioned public keys earlier, but before we dive into that, let’s understand encryption.

• Encryption: Converts readable data (plaintext) into unreadable data (ciphertext) using algorithms.
• Decryption: Converts ciphertext back into plaintext.

There are two types of encryption:

1. Symmetric Encryption
2. Asymmetric Encryption

Keys in Cryptography

Keys are random binary digits generated by tools like OpenSSL or programming libraries. Algorithms like AES-256 create these random bits.

Example:

• Random bits : 10110110 10001101 ..
• These bits can be represented in hexadecimal such as b6 8d ..
• Also we can use base64 to represent the bits such as* *to0=

Symmetric Encryption

Uses a single key for both encryption and decryption.

Symmetric Encryption

Example:

• You lock a box with a key (encryption).
• The same key is used to unlock the box (decryption).

Challenge: You need to securely share the key with the recipient.

Asymmetric Encryption

Uses a pair of keys: a public key and a private key.

The two keys are mathematically linked but cannot replace each other.

Encryption and Decryption:

• Public key: Encrypts data.
• Private key: Decrypts the data.

Digital Signing and Verification:

• Private key: Signs data digitally.
• Public key: Verifies the signature.

Asymmetric Encryption

Asymmetric Encryption is like sending a letter through a mailbox.

• Anyone can put a letter in the mailbox (use the public key to encrypt the data).
• Only the person with the key (the private key) can open the mailbox and read the letter (decrypt the data).

This way, only the person with the private key can read the message, even if others know where the mailbox is.

Combining Symmetric and Asymmetric Encryption

When my browser requests the website’s certificate, the server also sends its public key.

Here’s what happens next:

1. The browser verifies the certificate using the CA’s public key.
2. The browser generates a secret key (for symmetric encryption).
3. The secret key is encrypted using the server’s public key (asymmetric encryption) and sent to the server.
4. Both the browser and server now share the secret key.

From this point, all communication uses symmetric encryption because it’s faster. Also this is called TLS handshake ( Transport layer security handshake)

Hashing

When I sign up for the website, I enter a username and password. The connection between my browser and the server is secure, so my password cannot be intercepted.

But what happens if someone accesses the website’s database? That’s where hashing comes in.

Hashing converts plaintext into a fixed-length string that cannot be reversed (one-way).

Example:

• Password: mypassword → Hash: abcd123erteyui23973g

When you log in, the system hashes your input and compares it with the stored hash.

Salting

Hashing alone isn’t enough. If multiple people use the same weak password (12345), their hash values will also be identical. This makes it easier for attackers to guess passwords.

To solve this, we use salting: adding a random string to the password before hashing. This ensures all hashed passwords are unique.

Example:

• Without Salt: Password: 12345 → Hash: abcd1234 Password: 12345 → Hash: abcd1234
• With Salt: Password: 12345 + Salt: Xyz! → Hash: efgh5678 Password: 12345 + Salt: Pqr@ → Hash: ijkl9012

Wrap-Up

Great job! You’ve learned about encryption, hashing, salting, and how these concepts secure your data online.

Now, when someone talks about cryptography, step in confidently and share your knowledge!