Security

Complex systems are insecure by default. Vulnerabilities will exist in the hardware, the operating system, the tooling and the application code, and no amount of care removes that. The work is therefore risk mitigation rather than elimination:

• distribute trust, so no single component’s compromise is total
• reduce the attack surface
• isolate and compartmentalise, so a compromise stays where it started
• build layers of defence, so one control failing is not the end of it

Choosing the right controls is the whole exercise. End-to-end encryption is the strongest of them for data in transit, because it removes every intermediary from the set of parties that have to be trusted.

Encryption

Encryption transforms plaintext into ciphertext. Two components are involved:

• the algorithm, which is public and should be — an algorithm whose security depends on its being secret has not been reviewed by anyone
• the key, which is secret

Symmetric encryption

Symmetric encryption uses one key for both encryption and decryption. AES-256 is the current default choice, and AES-128 remains sound. Neither has a practical break: the weak point in a system built on AES is key management — how the key is derived, stored, rotated and destroyed — not the cipher.

A password is not a key. It is converted into one by a key derivation function, which applies a salt and a deliberately expensive computation so that guessing passwords offline stays slow. NIST SP 800-132 covers password-based key derivation for stored data.

This is also why a system that encrypts files with a password stores three things rather than two:

• the encrypted files
• the encryption key, itself encrypted under the key derived from the password
• a verifier for the password

The indirection is what makes a password change cheap. Without it, changing the password would mean decrypting and re-encrypting every file; with it, only the stored key has to be re-encrypted.

That leaves the harder question: how do two parties agree on a key in the first place?

Asymmetric encryption

Asymmetric encryption answers it, and makes digital signatures possible as a side effect. It uses a key pair: a public key that may be published, and a private key that must not be. What one key encrypts, only the other can decrypt — the same key cannot do both. RSA and the elliptic-curve algorithms are the common choices.

Encrypting with the recipient’s public key gives confidentiality. Anyone may send, only the holder of the private key may read. It says nothing about who the sender was, because the public key is public.

Encrypting with the sender’s own private key gives authentication: anyone can decrypt it with the sender’s public key, and the fact that they can is proof of who produced it.

Hash functions

A cryptographic hash function turns an input of any size into a fixed-size digest. The digest cannot be used to recover the input, and any change to the input changes the digest. That makes hashing the tool for integrity. Use SHA-256 or stronger; MD5 and SHA-1 are broken for any security purpose.

Digital signatures

A digital signature is a digest of the message encrypted with the sender’s private key. It provides three properties at once: integrity from the hash, authentication from the private key, and non-repudiation — the signer cannot later deny having produced it, because nobody else could have.

Encryption plus a digital signature therefore gives confidentiality, integrity, authentication and non-repudiation together.

Cryptosystems

A cryptosystem combines these primitives to deliver a set of security services:

• confidentiality — nobody but the intended recipient can read the message
• authentication — the other party is who they claim to be
• integrity — the message has not been altered
• non-repudiation — the sender cannot later deny having sent it

Not every cryptosystem provides all four, and which ones it provides is the thing to check. TLS provides confidentiality, integrity and server authentication — and client authentication when mutual TLS is configured. It does not provide non-repudiation: TLS protects record integrity with a symmetric key that both peers hold, so either peer could have produced any given transcript, and neither can prove to a third party what the other sent. Research protocols such as TLS-N and TLSNotary exist precisely to add that property on top.

PGP, by contrast, does provide non-repudiation, because each message is signed with the sender’s private key.

Hybrid cryptosystems

Asymmetric encryption is orders of magnitude slower than symmetric encryption, so it is not used for bulk data. A hybrid cryptosystem uses asymmetric cryptography once, to authenticate the parties and agree a shared symmetric key, then encrypts the traffic itself with a symmetric algorithm such as AES.

HTTPS is the example everyone touches daily: TLS performs an authenticated key exchange, then protects the session symmetrically. The particular combination of key exchange, authentication, bulk cipher and hash that a session settles on is called the cipher suite.