What is data encryption, and why is it important?

Data encryption is an essential technology that ensures information can only be read by authorised parties. It works by converting readable data into an encrypted form that can only be decrypted with a specific key. While data is stored or transmitted in encrypted form, it is protected against unauthorised access; it only needs to be decrypted when it is actually used.

In addition, many encryption systems use a combination of symmetric and asymmetric encryption to optimise security and performance: symmetric encryption uses the same key for both encryption and decryption, making it fast and efficient, while asymmetric encryption uses a pair of keys (a public and a private key) to ensure that only the intended recipient can decrypt the data. This enables data to be transmitted securely over insecure networks.

Compared with unencrypted data, which is vulnerable to eavesdropping and manipulation, encrypted data offers a far higher degree of security, mainly because it can only be decrypted by those who have the correct key, making encryption an essential component of modern data protection. Where data merely needs to be hidden from certain users, for example in log files or test environments, data masking is often used as a supplement.

Symmetric encryption is a method in which the same key is used for both encrypting and decrypting data. This type of encryption is known for its speed and efficiency, as it requires less computing power than asymmetric encryption. Symmetric encryption is ideal for situations in which large amounts of data need to be processed quickly, but it requires the key to be shared securely between the parties involved. If the key is compromised, the data can become accessible to unauthorised parties.

Asymmetric encryption, by contrast, uses a pair of keys: a public key for encryption and a private key for decryption. Its advantage is that the private key never has to be shared, which solves the problem of exchanging keys securely, but it is also more resource-intensive and slower than symmetric encryption. Asymmetric cryptography is often used for exchanging keys and authenticating parties, for example in digital signatures and the TLS protocol, the successor to SSL.

In practice, a combination of both methods is often used, in which asymmetric cryptography is used to secure the exchange of the symmetric key, which is then used to encrypt the data itself. This hybrid approach takes advantage of both technologies: the convenient key handling of asymmetric cryptography and the speed of symmetric encryption.

End-to-end encryption (E2EE) is a security technology that ensures only the sender and recipient of a message can read its content. The technology is increasingly used in apps to protect users’ privacy and data. Some of the key advantages and disadvantages of using end-to-end encryption in apps are:

• Improved privacy: End-to-end encryption ensures that only the parties involved can access the content of a message. Even the app provider cannot decrypt the messages, protecting users’ privacy against data collection and surveillance. Metadata, such as who communicates with whom and when, may, however, still be visible to the provider.
• Protection against eavesdropping: As the data is encrypted from sender to recipient, it becomes extremely difficult for hackers or unauthorised persons to intercept and read the messages. This makes E2EE effective protection against eavesdropping and data theft in transit, although it cannot protect messages on a device that has itself been compromised.
• Integrity and authentication: E2EE ensures that messages cannot be altered during transmission without being detected. This means that the recipient receives the original message, and if the parties verify each other’s keys, for example with safety numbers, they can also be confident of each other’s identity, strengthening trust between them.

Despite the many advantages, there are also some disadvantages to implementing end-to-end encryption in apps:

• Complexity of implementation: Integrating E2EE into an app can be technically challenging and requires considerable resources and expertise, which is why established protocols such as the Signal Protocol are usually used. This can be a barrier for smaller development teams or start-ups.
• Limited functionality: Some features, such as server-side search in messages or backup, can be difficult to implement with E2EE, as the data is encrypted and not accessible to servers.
• Regulatory challenges: In some countries, there may be legal requirements for access to communication data for law enforcement purposes. E2EE can make it difficult to meet such requirements, which can lead to legal challenges for app providers.

Overall, end-to-end encryption offers strong protection of users’ data and privacy, but it comes with technical and legal challenges that developers have to navigate. For many users and companies, however, the benefits of increased security and privacy are worth the investment, making E2EE a popular solution in modern apps.

To ensure that encryption is secure and reliable, it is important to choose well-tested methods and to implement several layers of security that protect against potential threats and vulnerabilities:

• Strong algorithm: An encryption algorithm should be chosen that is recognised and tested by cryptographic experts, such as AES (Advanced Encryption Standard) or RSA, preferably in an authenticated mode such as AES-GCM. These algorithms have undergone extensive evaluation and are known for their robustness, and home-made algorithms should never be used.
• Key length: A sufficiently long key should be used to prevent brute-force attacks. AES with 128-bit keys is considered secure today, and 256-bit keys are often recommended for high security and long-term protection, while RSA keys should be at least 2048 and preferably 3072 bits.
• Regular updates: Encryption libraries and software should be kept up to date to protect against new vulnerabilities and attack techniques. This includes applying security updates and patches as soon as they become available and phasing out algorithms that are no longer considered secure.
• Implementation security: The encryption must be implemented correctly in software and hardware, preferably using well-established libraries and the platforms’ own cryptography APIs. Implementation errors can lead to security flaws, even with strong algorithms.
• Use of salts and initialisation vectors (IVs): Random IVs or nonces should be used in encryption so that even identical data results in different encrypted output, making it harder for attackers to find patterns, while salts are used when hashing passwords and deriving keys from passwords.
• Access control and authentication: Strong access control mechanisms and authentication protocols should be implemented to ensure that only authorised users can access encrypted data, and keys should be stored securely, for example in the device’s hardware-backed keystore.
• Regular audits and testing: Regular security audits and penetration tests help to identify and remedy potential weaknesses in the encryption system.

Overall, the combination of strong algorithms, sufficient key length, regular updates, correct implementation, the use of salts and IVs, access control and regular audits helps to keep encryption secure and reliable over time.

Data encryption is a critical component in protecting sensitive information, and there are several legal requirements and standards that organisations should be aware of when implementing encryption technologies. These requirements vary by region and industry, but some of the most common include:

GDPR (General Data Protection Regulation): The GDPR is comprehensive data protection legislation that applies to organisations that process personal data about people in the EU. Under the GDPR, encryption is recognised as an appropriate technical measure for protecting personal data. Organisations must ensure that their measures are sufficient to protect data against unauthorised access and data breaches, and if lost data was properly encrypted, it may not be necessary to notify the affected individuals.

HIPAA (Health Insurance Portability and Accountability Act): For organisations that handle health information in the USA, HIPAA is crucial legislation. Under HIPAA, encryption of protected health information (PHI) in storage and transmission is an “addressable” requirement: it is not mandatory in all cases, but if it is not used, the organisation must document why and which equivalent security measures are used instead.

PCI DSS (Payment Card Industry Data Security Standard): PCI DSS is a global industry standard, not legislation, that applies to all organisations handling payment card data. The standard requires card data to be encrypted when transmitted over open, public networks and stored card numbers to be made unreadable, for example by encryption. This helps to protect payment information against interception and misuse.

FISMA (Federal Information Security Management Act): FISMA applies to US federal agencies and requires them to protect federal information systems against threats. Encryption is one of the technologies that can be used to meet FISMA’s information security requirements.

Implementing data encryption requires a thorough understanding of the relevant legal requirements and standards. Organisations must ensure that their encryption solutions not only meet the technical requirements but also comply with applicable legislation in order to avoid sanctions and protect their users’ data effectively.

The list above is not exhaustive, and the requirements that apply depend on the country, the industry and the type of data, so it is advisable to obtain legal advice before an app that handles sensitive data is launched.

Encryption is usually not noticed by the user, as it takes place automatically in the background. Modern devices and servers have hardware that makes encryption fast, so HTTPS and encrypted storage do not normally cause a noticeable delay.

Encryption can, however, affect the experience in other ways. With end-to-end encryption, the service itself cannot read the data, so features such as server-side search and recovery of forgotten passwords may be limited. The user may be asked to keep a recovery key. On the other hand, encryption provides peace of mind, and many users appreciate being able to see that their data is protected.