Cryptography in Cybersecurity: Keeping Your Data Safe

Protecting sensitive information from unauthorized access matters more than it ever has. Cryptography is how that gets done: it transforms plaintext into unreadable ciphertext so that only authorized parties can access the data.

Types of cryptography

There are two: symmetric and asymmetric.

Symmetric cryptography

Symmetric cryptography uses a single secret key for both encryption and decryption. Since that key has to stay confidential, it fits encrypted communication between two parties who have already exchanged keys. AES (Advanced Encryption Standard) is the standard today; DES, its predecessor, is broken and survives only in legacy systems.

Asymmetric cryptography

Asymmetric cryptography, also known as public-key cryptography, uses a pair of keys: a public key for encryption and a private key for decryption. The two parties do not need to have exchanged a secret key beforehand, which is what makes it suitable for key exchange and digital signatures. RSA (Rivest-Shamir-Adleman) and Elliptic Curve Cryptography (ECC) are the common ones.

Real-world applications

Secure online communication

SSL/TLS certificates bind a website’s identity to a public key so browser and server can authenticate each other and agree session keys; the session keys then encrypt the data moving between them. That is what stops an eavesdropper on the network from reading passwords or credit card numbers as they pass.

Authentication

Multi-factor authentication uses cryptography to verify a user’s identity, but the mechanism matters. An authenticator app computes a time-based one-time password locally on the device, an HMAC over a shared secret and the clock (TOTP, RFC 6238); nothing travels except the six digits you type. SMS codes are the weak variant: NIST treats phone-delivered codes as a restricted authenticator because of SIM swaps and signaling attacks. Where phishing resistance matters, FIDO2/WebAuthn hardware-backed keys are the current answer.

Data at rest encryption

Encrypt data at rest and an attacker who reaches the system or the storage device still cannot read it without the decryption key. Full disk encryption is the broad version, covering an entire hard drive so a stolen machine does not hand over its contents.

Other techniques used alongside these

Hash functions

A hash function produces a fixed-length output representing the input data. Change the input slightly and the output changes completely, which is what makes hashes useful as digital fingerprints. SHA-256 (Secure Hash Algorithm 256) is the common choice today; MD5 (Message-Digest Algorithm 5) is an older one whose collision resistance is long broken, leaving it fit only for detecting accidental corruption.

Digital signatures

Digital signatures combine hash functions with asymmetric cryptography to produce a unique code that verifies a message or document is authentic. They are commonly used for software development and legal documents.

Where it gets difficult

Key management

Key management is the hard part, particularly across a large organization with many users and devices. Losing the only copy of a key locks you out of the data it was protecting, and a compromised key puts everything encrypted with it at risk.

Quantum computing

Future quantum computers may be able to break many of the encryption algorithms in use today. Researchers and developers are working on post-quantum cryptography, which uses new approaches to resist attacks from future quantum computers.

References

[1] FIPS 197: Advanced Encryption Standard (AES), NIST

[2] FIPS 180-4: Secure Hash Standard (SHA-2 family), NIST

[3] RFC 6151: Updated Security Considerations for MD5 and HMAC-MD5

[4] NIST SP 800-63B: Digital Identity Guidelines, Authentication and Authenticator Management

[5] RFC 6238: TOTP, Time-Based One-Time Password Algorithm