1.4Encryption methods and their application

Encryption is the central tool for achieving "seen but not read," but misjudging where to use it causes the accident of believing you are protected when you are not. Different methods have different roles: one fast but with hard key distribution, one that solves key distribution but is slow, and a mechanism that is not encryption at all but detects tampering. This section covers the difference between symmetric and asymmetric encryption, the hash that is easily confused with encryption, the certificate and PKI that assure a public key's correctness, strong vs. weak algorithms, and how to protect data in each state—in transit, at rest, in use—learned not by rote but through the lens of choosing the right tool for the situation.

1.4.1Symmetric, asymmetric, and hashing

• Symmetric encryption uses the same key to encrypt and decrypt (e.g., AES). It is fast and suited to large data, but the challenge is key distribution—safely delivering the key to the other party. If the shared key leaks, the communication can be decrypted.
• Asymmetric (public-key) encryption uses a public/private key pair (e.g., RSA/ECC). What the public key encrypts can only be decrypted by the paired private key, making key distribution easy and safe. Because it is slower than symmetric, practice often combines them: "use asymmetric to safely share a symmetric key, then encrypt the bulk quickly with symmetric."
• A hash is a one-way function that converts any data into a fixed-length value (e.g., SHA-256). It cannot be reversed and is not encryption. It is used to detect tampering (verify integrity) and to store passwords (the same input always yields the same value; a small change alters the value greatly). The key point is that a hash is not encryption.

1.4.2Certificates, PKI, strength, and data states

• A certificate (digital certificate) is an electronic ID that assures "this public key truly belongs to this party." A trusted third party, a Certificate Authority (CA), issues and signs it. The whole system of issuing, revoking, and trusting is the PKI (Public Key Infrastructure). The padlock in HTTPS means a valid certificate confirmed the other party's authenticity.
• A strong algorithm is one still considered secure (AES-256, SHA-256, RSA-2048 or higher). A weak algorithm is one with established break methods that should not be used (DES, RC4, MD5, SHA-1). Because strength is reassessed over the years, it matters not to keep using old defaults as-is.
• Data has three states, each protected differently: in transit = while flowing over the network (protected by TLS/IPsec), at rest = stored on disk (protected by disk encryption/BitLocker), and in use = while processed in memory (protected by access control and dedicated memory protection—the hardest state).

Suppose you are asked to "inspect the security of an internal web system that handles customer information." Jumping to "we hash passwords, so encryption is airtight" is dangerous, because a hash is one-way and effective for tamper detection and password storage, but it is a tool for integrity, not encryption, and does not provide confidentiality for communications or stored data. Properly, verify protection by each data state. First, in transit—is the traffic between the user's browser and the server encrypted with TLS (HTTPS), and are the padlock and certificate valid (issued by a trusted CA, not expired or mismatched)? Inside TLS, the combination works: slow asymmetric encryption safely shares a symmetric key, and the bulk traffic is encrypted with fast symmetric encryption (AES). Next, at rest—is the customer data on the server's or laptop's disk protected by disk encryption (such as BitLocker), so it cannot be read if stolen or lost? Finally, in use—data being processed in memory is the hardest to protect, complemented by access control and suppressing unnecessary memory dumps. Additionally, inspect whether the methods in use are strong algorithms (AES-256/SHA-256 are good; ensure no weak algorithms like DES/RC4/MD5/SHA-1 remain). The key is the thinking: not "is it encrypted" but "which state of data is protected, with which tool (TLS / disk encryption / hash), using a sufficiently strong algorithm," verified state by state. At the introductory stage, holding this "state x tool x strength" measuring stick is the shortcut to finding the holes behind a false sense of protection.

1.4.3Section summary

• Symmetric encryption (AES) is fast with one key but has the key-distribution challenge; asymmetric encryption (RSA/ECC) solves distribution via a key pair but is slow; a hash (SHA-256) is one-way for integrity and is not encryption
• Certificates and a CA assure a public key's authenticity, and the whole is the PKI; distinguish strong = AES-256/SHA-256 from weak = DES/RC4/MD5
• Protection differs by data state: in transit = TLS/IPsec, at rest = disk encryption, in use = memory protection—verify state by state