Encryption
Implementing symmetric and asymmetric encryption.
🎯 Learning Objectives
- ▸ Understand symmetric vs asymmetric encryption
- ▸ Learn how to manage encryption keys
- ▸ Implement encryption at rest and in transit
Symmetric vs Asymmetric
There are two main types of encryption:
- • Symmetric Encryption: Uses the same key to encrypt and decrypt. It is very fast. Example: AES-256.
- • Asymmetric Encryption: Uses a public key to encrypt and a private key to decrypt. It is slower but solves the key distribution problem. Example: RSA, ECC.
In practice, most systems use a hybrid approach: they use asymmetric encryption to share a symmetric key, and then use the symmetric key to encrypt the actual data.
Key Management
If you hardcode your encryption key in your source code, you are doing it wrong. Keys must be stored in a secure vault (like AWS KMS, HashiCorp Vault, or Azure Key Vault) and rotated regularly.
The DPDPA mandates "reasonable security safeguards." Using outdated algorithms like MD5 or SHA-1 for encryption is not reasonable. Use modern standards (AES-256, SHA-256).
📖 Glossary
- AES-256
- Advanced Encryption Standard with a 256-bit key, considered highly secure and used by governments worldwide.
- Key Rotation
- The process of changing an encryption key periodically to reduce the risk of compromise.
🔑 Key Takeaways
- Symmetric encryption (AES) is fast and used for bulk data.
- Asymmetric encryption (RSA, ECC) is used for key exchange and digital signatures.
- Key management is the hardest part of encryption.
📚 Further Reading
- NIST Special Publication 800-57 — NIST (2020)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...