# data[].attributes.body
Sifer adalah kaedah memproses maklumat dengan cara mengubahnya menjadi kod atau simbol agar tidak dapat dibaca atau dikenali kecuali oleh individu yang mempunyai keizinan. Tujuan utama sifer adalah untuk menjaga kerahsiaan maklumat semasa penghantaran data di internet atau media penyimpanan lain.

# data[].attributes.body
Proses sifer bermula dengan plaintext, yang ialah data asal yang tidak disulitkan. Kemudian, dengan menggunakan kunci sifer dan algoritma sifer tertentu, plaintext ini akan disulitkan (encrypted) menjadi ciphertext yang sukar untuk dibaca tanpa mempunyai kunci untuk membukanya (decryption). Proses penyulitan ini membantu dalam melindungi maklumat dari pihak yang tidak berkepentingan.

# data[].attributes.body
Dalam kaedah simetri, kunci yang sama digunakan untuk penyulitan dan penyahsulitan. Ini bermakna penyulit dan penerima maklumat perlu berkongsi kunci yang sama dengan cara yang selamat. Kaedah ini efektif untuk penghantaran data yang cepat tetapi memerlukan pengurusan kunci yang berkesan untuk mengelakkan risiko keselamatan.

# data[].attributes.attachment_link.readable_text
In today's cyber-world there is an ever-present risk of unauthorized access to all forms of data. Most at risk is financial and payment system data that can expose the personally identifiable information (PII) or payment card details of customers and clients. Encryption is essential for protecting PII and mitigating the risks that businesses, which process payment transactions, face every minute of every single day.

This article discusses symmetric encryption in banking, its benefits, and some key management challenges.

What is Symmetric Encryption?

Symmetric encryption is a type of encryption key management solution where only one key (a secret key) is used to both encrypt and decrypt electronic data. The entities communicating via symmetric encryption must exchange the key so that it can be used in the decryption process. This encryption method differs from asymmetric encryption where a pair of keys - one public and one private - is used to encrypt and decrypt messages.

By using symmetric encryption algorithms, data is "scrambled" so that it can't be understood by anyone who does not possess the secret key to decrypt it. Once the intended recipient who possesses the key has the message, the algorithm reverses its action so that the message is returned to its original readable form. The secret key that the sender and recipient both use could be a specific password/code or it can be random string of letters or numbers that have been generated by a secure random number generator (RNG). For banking-grade encryption, the symmetric keys must be created using an RNG that is certified according to industry standards, such as FIPS 140-2.

There are two types of symmetric encryption algorithms:

1. Block algorithms. Set lengths of bits are encrypted in blocks of electronic data with the use of a specific secret key. As the data is being encrypted, the system holds the data in its memory as it waits for complete blocks.

2. Stream algorithms. Data is encrypted as it streams instead of being retained in the system's memory.

Some examples of symmetric encryption algorithms include:

AES (Advanced Encryption Standard)

DES (Data Encryption Standard)

IDEA (International Data Encryption Algorithm)

Blowfish (Drop-in replacement for DES or IDEA)

RC4 (Rivest Cipher 4)

RC5 (Rivest Cipher 5)

RC6 (Rivest Cipher 6)

AES, DES, IDEA, Blowfish, RC5 and RC6 are block ciphers. RC4 is stream cipher.

DES

In "modern" computing, DES was the first standardized cipher for securing electronic communications, and is used in variations (e.g. 2-key or 3-key 3DES). The original DES is not used anymore as it is considered too "weak", due to the processing power of modern computers. Even 3DES is not recommended by NIST and PCI DSS 3.2, as well as all 64-bit ciphers. However, 3DES is still widely used in EMV solutions and chip cards because of legacy applications that do not have a crypto-agile infrastructure.

AES

The most commonly used symmetric algorithm is the Advanced Encryption Standard (AES), which was originally known as Rijndael. This is the standard set by the U.S. National Institute of Standards and Technology in 2001 for the encryption of electronic data announced in U.S. FIPS PUB 197. This standard supersedes DES, which had been in use since 1977. Under NIST, the AES cipher has a block size of 128 bits, but can have three different key lengths as shown with AES-128, AES-192 and AES-256.

What is Symmetric Encryption Used For?

While symmetric encryption is an older method of encryption, it is faster and more efficient than asymmetric encryption, which takes a toll on networks due to performance issues with data size and heavy CPU use. Due to the better performance and faster speed of symmetric encryption (compared to asymmetric), symmetric cryptography is typically used for bulk encryption / encrypting large amounts of data, e.g. for database encryption. In the case of a database, the secret key might only be available to the database itself to encrypt or decrypt. Industry-standard symmetric encryption is also less vulnerable to advances in quantum computing compared to the current standards for asymmetric algorithms (at the time of writing).

Some examples of where symmetric cryptography is used are:

Payment applications, such as card transactions where PII needs to be protected to prevent identity theft or fraudulent charges

Validations to confirm that the sender of a message is who he claims to be

Random number generation or hashing

Key management for symmetric encryption - what we need to consider

Unfortunately, symmetric encryption does come with its own drawbacks. Its weakest point is its aspects of key management, including:
Key Exhaustion
Symmetric Encryption suffers from behavior where every use of a key 'leaks' some information that can potentially be used by an attacker to reconstruct the key. The defenses against this behavior include using a key hierarchy to ensure that master or key-encryption keys are not over-used and the appropriate rotation of keys that do encrypt volumes of data. To be tractable, both these solutions require competent key management software and strategies as if (for example) a retired encryption key cannot be recovered the data is potentially lost.
Attribution data
Unlike asymmetric (public-key) Certificates, symmetric keys do not have embedded metadata to record information such as expiry date or an Access Control List to indicate the use the key may be put to - to Encrypt but not Decrypt for example.

The latter issue is somewhat addressed by standards such as ANSI X9-31 where a key can be bound to information prescribing its usage. But for full control over what a key can be used for and when it can be used, an encryption key management solution is required.
Key Management at large scale
Where only a few keys are involved in a scheme (tens to low hundreds), the management overhead is modest and can be handled through manual, human activity. However, with a large estate, tracking the expiration and arranging rotation of keys quickly becomes impractical.

Consider an EMV payment card deployment: millions of cards multiplied by several keys-per-card requires a dedicated provision and encryption key management solution.

Conclusion

Maintaining large-scale symmetric encryption systems is a very challenging task. This is especially true when we want to achieve banking-grade security and auditability when the corporate and/or IT architecture is decentralized / geographically distributed.

In order to do this properly, it is recommended to use special software to maintain the proper life-cycle for each key created. In instances of massive key enrollment, it is truly impossible to conduct key management manually. We need specialized key management software for it.

Quantum computing is expected to materialize within the next 5-10 years. Already today, NIST advises to replace the widely used 3DES algorithm with algorithms which we consider to be more save, based on today's knowledge.

Not knowing what progress in technology and hence in the evolution malicious decryption-algorithms may be, we strongly advise banks to migrate to a crypto-agile setup. When weaknesses are identified, such a setup will allow for the rapid replacement of algorithms with more secure algorithms. Investment and architectural decisions must be made now in order to avoid major damage in the coming years.

Cryptomathic's key management software delivers a comprehensive crypto-agility security solution that allows organizations to prepare for the post-quantum era with ease. Contact us now to learn how this cutting-edge technology can help you protect your critical information today.

References and Further Reading

# data[].attributes.attachment_link.title
Symmetric Key Encryption - why, where and how it's used in banking

# data[].attributes.attachment_link.description
In this article, we will discuss symmetric encryption in banking, benefits and some of the difficulties associated with managing the keys.

# data[].attributes.body
Berbeza dengan kaedah simetri, kaedah asimetri menggunakan sepasang kunci; satu untuk penyulitan dan satu lagi untuk penyahsulitan. Kunci umum (public key) digunakan untuk menyulitkan maklumat, manakala kunci peribadi (private key) digunakan untuk menyahsulitkan. Kaedah ini lebih selamat dan sesuai untuk penghantaran data dalam skala yang lebih besar.

# data[].attributes.attachment_link.readable_text
Graphic: In this blog post, we discuss the differences between symmetric encryption, a single-key encryption technique, and asymmetric encryption, also known as public-key cryptography, which uses private- and public-key pairs of encryption keys.

To transmit a key or not to transmit a key. That is the question.

There are two main forms of data encryption in use today: symmetric encryption and asymmetric encryption. Every day, when you're using your web browser, responding to emails, submitting website forms, and other activities, symmetric and asymmetric encryption processes are happening, sometimes unbeknownst to you. You may also be familiar with symmetric and asymmetric encryption because you have experience with OpenSSL, key management services, or maybe you've sent an encrypted email or encrypted a Microsoft Word or Adobe PDF file with a password before.

It's important to understand the differences between symmetric and asymmetric encryption and how these security technologies work in the everyday secure transfer of communications. You'll know what these terms mean when you see them, and you'll also be knowledgeable of how they work, their various iterations, aware of their capabilities, and know which is more advisable to implement with regard to securing and authenticating the origin of sensitive information.

In this blog post, we'll discuss the differences between symmetric and asymmetric encryption. At the end, we'll summarize these differences and discuss related encryption options for securing your sensitive data.

Graphic: Symmetric encryption uses a single key to encrypt and decrypt information.

What is symmetric encryption?

Symmetric encryption is a widely used data encryption technique whereby data is encrypted and decrypted using a single, secret cryptographic key.

Specifically, the key is used to encrypt plaintext - the data's pre-encryption or post-decryption state - and decrypt ciphertext - the data's post-encryption or pre-decryption state.

Symmetric encryption is one of the most widely used encryption techniques and also one of the oldest, dating back to the days of the Roman Empire. Caesar's cipher, named after none other than Julius Caesar, who used it to encrypt his military correspondence, is a famous historical example of symmetric encryption in action.

The goal of symmetric encryption is to secure sensitive information. It's used daily in many major industries, including defense, aerospace, banking, health care, and other industries in which securing a person's, business', or organization's sensitive data is of the utmost importance.

Graphic: This is an illustration of the symmetric encryption process.

How does symmetric encryption work?

Symmetric encryption works by using either a stream cipher or block cipher to encrypt and decrypt data. A stream cipher converts plaintext into ciphertext one byte at a time, and a block cipher converts entire units, or blocks, of plaintext using a predetermined key length, such as 128, 192, or 256 bits.

Senders and recipients using symmetric encryption to transfer data to each other must know the secret key to, in the case of senders, encrypt the data they intend to share with recipients, and in the case of recipients, decrypt and read the encrypted data the senders share with them, as well as encrypt any necessary responses.

Here's a simplified example of symmetric encryption: if Claire, the sender, wants to send Jacqueline, the recipient, a confidential document, Claire would use the secret key to encrypt the file and send it to Jacqueline, who would be unable to read its contents until she entered the same key that Claire just used to encrypt the file. Conversely, if Jacqueline makes changes to the document and wishes to share them with Claire, she'd use the same key to re-encrypt the file and send it back to Claire, who will use the same key to decrypt the file and access its contents, and the process repeats itself.

Note that this is just an example used to simplify how symmetric encryption works. Symmetric encryption may be carried out manually or automatically.

Symmetric encryption is not limited to the sharing of data between one sender and one recipient, however. Symmetrically encrypted information can be accessed by anyone - Claire, Jacqueline, their co-worker Frank, their boss, Jennifer, et al. - who knows the secret key. Therein lies the reason why concealing the shared cryptographic key from unauthorized parties is vital to the success of symmetric encryption and the integrity of symmetrically encrypted data.

Graphic: Examples of symmetric encryption include the Advanced Encryption Standard (AES) and TLS/SSL protocol.

What are some examples of symmetric encryption?

Popular examples of symmetric encryption include the:

Data Encryption Standard (DES)

Triple Data Encryption Standard (Triple DES)

Advanced Encryption Standard (AES)

International Data Encryption Algorithm (IDEA)

TLS/SSL protocol

AES encryption, which uses block ciphers of 128, 192, or 256 bits to encrypt and decrypt data, is one of the most well-known and effective symmetric encryption techniques in use today. It would take billions of years to crack, and that's why it's used to secure sensitive information in government, healthcare, banking, and other industries. It is more secure than DES, Triple DES, and IDEA.

DES encryption is now considered by the National Institute of Standards and Technology (NIST) to be a legacy symmetric encryption algorithm because it has long been ineffective at safeguarding sensitive information from brute-force attacks. In fact, the NIST has withdrawn the standard entirely, and its more secure big brother, Triple DES encryption, will have the same fate. Although still in use today, Triple DES encryption is being withdrawn and disallowed by the NIST in 2023 because of mounting security concerns.

IDEA encryption was developed as a replacement for DES in the 1990s, but AES was ultimately deemed more secure. The IDEA is now an open and free block-cipher algorithm, so anyone can use it, but it's generally considered to be obsolete and ineffective at securing sensitive information today. AES encryption is the gold standard for both purposes.

Transport Layer Security (TLS), as well as its predecessor, Secure Sockets Layer (SSL), uses symmetric encryption. Basically, when a client accesses a server, unique symmetric keys, called session keys, are generated. These session keys are used to encrypt and decrypt the data shared between the client and the server in that specific client-server session at that specific point in time. A new client-server session would generate new, unique session keys.

TLS/SSL uses not only symmetric encryption but both symmetric and asymmetric encryption, to ensure the security of client-server sessions and the information exchanged within them.

Graphic: Advantages of symmetric encryption include security, speed, and industry adoption and acceptance.

What are some advantages of symmetric encryption?

Symmetric encryption is used today because it can encrypt and decrypt large amounts of data quickly, and it's easy to implement. It's simple to use, and its AES iteration is one of the most secure forms of data encryption available.

Now, symmetric encryption has several advantages over its asymmetric counterpart, but we'll talk about asymmetric encryption in this blog post a little later.

Some advantages of symmetric encryption include:

Security: symmetric encryption algorithms like AES take billions of years to crack using brute-force attacks.

Speed: symmetric encryption, because of its shorter key lengths and relative simplicity compared to asymmetric encryption, is much faster to execute.

Industry adoption and acceptance: symmetric encryption algorithms like AES have become the gold standard of data encryption because of their security and speed benefits, and as such, have enjoyed decades of industry adoption and acceptance.

Graphic: Disadvantages of symmetric encryption include the need to ensure the security of key distribution mechanisms.

What are some disadvantages of symmetric encryption?

By far the biggest disadvantage of symmetric encryption is its use of a single, secret cryptographic key to encrypt and decrypt information.

Why?

Well, if this secret key is stored in an insecure location on a computer, then hackers could gain access to it using software-based attacks, allowing them to decrypt the encrypted data and thereby defeating the entire purpose of symmetric encryption.

In addition, if one party or entity is encrypting at one location and a separate party or entity decrypting at a second, then the key will need to be transmitted, leaving it vulnerable to interception if the transmission channel is compromised.

That's why it's crucial to ensure the security of the encryption key at rest and in transit. Otherwise, you're just asking for a litany of independent and state-sponsored cyberattackers to access your mission-critical, safety-critical, or legally protected data.

The only other disadvantage to using symmetric encryption is its security efficacy when compared to asymmetric encryption, which is generally considered to be more secure but also slower to execute than symmetric encryption.

But is asymmetric encryption more secure than symmetric encryption? Let's find out.

Graphic: Asymmetric encryption uses public- and private-key pairs to encrypt and decrypt sensitive information.

What is asymmetric encryption?

Unlike symmetric encryption, which uses the same secret key to encrypt and decrypt sensitive information, asymmetric encryption, also known as public-key cryptography or public-key encryption, uses mathematically linked public- and private-key pairs to encrypt and decrypt senders' and recipients' sensitive data.

As with symmetric encryption, plaintext is still converted into ciphertext and vice versa during encryption and decryption, respectively. The main difference is that two unique key pairs are used to encrypt data asymmetrically.

How does asymmetric encryption work?

Here's a simplified example of asymmetric encryption: if Claire, the sender, and Jacqueline, the recipient, want to continually send a confidential file back and forth to each other, Claire and Jacqueline will give their unique and respective public keys to each other. Claire will then use Jacqueline's public key to encrypt the file, since it's intended for Jacqueline only, and send the file to Jacqueline. Upon receipt of the file, Jacqueline will use her private key - keyword, "private," meaning no one else other than Jacqueline knows it - to decrypt the file and access its contents. No one other than Jacqueline, not even Claire, can decrypt this file, because no one other than Jacqueline knows Jacqueline's private key. The same process applies when Jacqueline wants to send the file back to Claire. Jacqueline ties it to Claire's public key, and Claire uses her private key to decrypt the file.

Note that this is a simplification of asymmetric encryption. Like symmetric encryption, asymmetric encryption may be carried out manually or automatically.

Now, do you see how asymmetric encryption could be seen as more secure than symmetric encryption? While this is an interesting inquiry, it's not the right question to ask, really, because, technically, whether symmetric or asymmetric encryption is more secure depends largely on key size and the security of the media that stores or transmits cryptographic keys.

One reason asymmetric encryption is often regarded as more secure than symmetric encryption is that asymmetric encryption, unlike its counterpart, does not require the exchange of the same encrypt-decrypt key between two or more parties. Yes, public keys are exchanged, but users sharing data in an asymmetric cryptosystem have unique public and private key pairs, and their public keys, because they're used for encryption only, pose no risk of unauthorized decryption by hackers should they become known, because the hackers, assuming private keys are kept private, don't know the users' private keys and thus cannot decrypt the encrypted data.

Asymmetric encryption also allows for digital signature authentication, unlike symmetric encryption. Basically, this involves using private keys to digitally sign messages or files, and their corresponding public keys are used to confirm that these messages originated from the correct, verified sender.

Graphic: Examples of asymmetric encryption include Rivest Shamir Adleman (RSA) and the Digital Signature Algorithm (DSA).

What are some examples of asymmetric encryption?

Examples of asymmetric encryption include:

Rivest Shamir Adleman (RSA)

the Digital Signature Standard (DSS), which incorporates the Digital Signature Algorithm (DSA)

Elliptical Curve Cryptography (ECC)

the Diffie-Hellman exchange method

TLS/SSL protocol

Published in 1977, RSA is one of the oldest examples of asymmetric encryption. Developed by Ron Rivest, Adi Shamir, and Leonard Adleman, RSA encryption generates a public key by multiplying two large, random prime numbers together, and using these same prime numbers, generates a private key. From there, standard asymmetric encryption takes place: information is encrypted using the public key and decrypted using the private key.

The DSS, which incorporates the Digital Signature Algorithm (DSA), is the perfect example of asymmetric digital signature authentication. A sender's private key is used to digitally sign a message or file, and the recipient uses the sender's corresponding public key to confirm that the signature originated from the correct sender and not a suspicious or unauthorized source.

ECC is an RSA alternative that uses smaller key sizes and mathematical elliptic curves to execute asymmetric encryption. It's frequently used to digitally sign cryptocurrency transactions; in fact, the popular cryptocurrency Bitcoin uses ECC - the Elliptic Curve Digital Signature Algorithm (ECDSA), to be exact - to digitally sign transactions and ensure that funds are spent by authorized users only. ECC is much faster than RSA in terms of key and signature generation, and many consider it the future of asymmetric encryption, mainly for web traffic and cryptocurrency but for other applications as well.

Diffie-Hellman, one of cryptography's greatest breakthroughs, is a key exchange method that two parties who have never met can use to exchange public and private key pairs over public, insecure communication channels. Prior to Diffie-Hellman, two parties seeking to encrypt their communications between each other had to physically pre-exchange encryption keys so that both parties could decipher each other's encrypted messages. Diffie-Hellman made it so that these keys could be securely exchanged over public communication channels, where third parties normally extract sensitive information and encryption keys.

TLS/SSL uses asymmetric encryption to establish a secure client-server session while the client and server are generating symmetric encryption keys. This is known as a TLS handshake. After the TLS handshake is complete, the client-server session keys are used to encrypt the information exchanged in that session.

Graphic: Advantages of asymmetric encryption include digital signature authentication and increased security due to the privacy of decryption keys.

What are some advantages of asymmetric encryption?

Advantages of using asymmetric encryption include:

Key distribution not necessary: securing key distribution channels has long been a headache in cryptography. Asymmetric encryption eliminates key distribution entirely. The needed public keys are exchanged through public-key servers, and the disclosure of public keys is not, at this time, detrimental to the security of encrypted messages, because they cannot be used to derive private keys.

Exchange of private keys not necessary: with asymmetric encryption, private keys should remain stored in a secure location and thus private to the entities using them. Basically, the keys needed to decrypt sensitive information are never, and should not ever be, exchanged over a potentially compromised communication channel, and that's a major plus for the security and integrity of encrypted messages.

Digital signature/message authentication: with asymmetric encryption, senders can use their private keys to digitally sign and verify that a message or file originated from them and not an untrusted third party.

It may seem like there's no going wrong with asymmetric encryption. I mean, why would you ever choose symmetric encryption if asymmetric encryption is so secure?

One word: speed.

Graphic: Disadvantages of asymmetric encryption include slowness of execution when compared to symmetric encryption.

What are some disadvantages of asymmetric encryption?

The main disadvantage of asymmetric encryption is that it's slower than symmetric encryption because of its longer key lengths, not to mention that asymmetric encryption calculations tend to be much more complex than their symmetric counterparts.

Why? Because, in theory, public keys can be used to crack private keys - again, they're mathematically linked - but asymmetric encryption uses extraordinarily long key lengths to make this virtually impossible, at least for now.

So, in a nutshell, symmetric encryption is faster than asymmetric encryption. Asymmetric encryption sacrifices speed for security, while symmetric encryption sacrifices security for speed.

Now, this is not to say that symmetric encryption is insecure; however, the very foundation of asymmetric encryption eliminates several information security risks that still exist within poorly managed symmetric encryption cryptosystems.

Graphic: Let's summarize the "key" differences between symmetric and asymmetric encryption.

Conclusion: summary of key differences

The key differences between symmetric and asymmetric encryption are speed and security preferences. Generally speaking, symmetric encryption is faster and simpler but is often viewed as less secure than asymmetric encryption. But as we've discussed, encryption really boils down to two things: key size and the security of the media storing encryption keys.

Symmetric encryption is much faster to execute because of its shorter key lengths. Asymmetric encryption has a tendency to bog down networks because of its longer key lengths and complex algorithms. These are the tradeoffs worth considering when deciding which type of encryption to employ.

At Trenton Systems, we offer data encryption solutions in our high-performance servers and workstations in the form of AES-compliant, Opal-compliant, and FIPS-140-2-compliant self-encrypting drives (SEDs).

Pair this with our technology partner FUTURA Cyber's Crypto Management Platform (CMP), and you've crafted a secure, well-managed computer capable of withstanding common attacks on your sensitive data.

For more information about how we ensure the integrity of your data using data encryption, reach out to us today.

# data[].attributes.attachment_link.title
Symmetric vs. Asymmetric Encryption: What's the Difference?

# data[].attributes.attachment_link.description
Learn more about the differences between the two main types of encryption: symmetric vs. asymmetric encryption.