5.3: Protecting Stored Data with Cryptography

Essential Questions

• How does encryption transform readable data into unreadable code that protects files even if they're stolen?
• What is the difference between plaintext and ciphertext, and how does a key control the transformation?
• Why do block ciphers like AES process data in fixed chunks rather than one bit at a time?
• How does the size of the keyspace determine how long it would take an attacker to break the encryption?
• What are the practical steps to encrypt and decrypt files using command-line tools like OpenSSL?

Overview

Picture this: you've just finished researching your family history and compiled sensitive documents including birth certificates, social security numbers, and financial records into a folder on your laptop. Tomorrow, you're traveling with that laptop through busy airports and staying in hotels with questionable Wi-Fi. The thought hits you—what happens if someone steals your device or gains access to your files? All that private information would be completely exposed, readable by anyone who opens the folder.

This is where cryptography becomes your digital guardian. Encryption transforms your readable documents into scrambled, meaningless data that looks like random noise to anyone without the proper key. Even if an attacker steals your entire hard drive, they'll find nothing but digital gibberish where your sensitive files used to be. The original information is still there, perfectly preserved, but it's locked behind a mathematical puzzle that would take thousands of years to solve without the key.

In this lesson, you'll explore how encryption algorithms work to protect files at rest, understand the fundamental concepts of plaintext, ciphertext, and keys, and learn to use industry-standard tools like AES to secure your own data. You'll discover why symmetric encryption—where the same key both locks and unlocks information—forms the backbone of modern data protection, from encrypted hard drives to secure messaging apps.

How Encryption Can Be Used to Protect Files (5.3.A)

The fundamental purpose of cryptography is to hide information from those who shouldn't see it. When you encrypt a file, you're essentially running it through a mathematical transformation that makes it unreadable to anyone who doesn't possess the correct key. Think of it like translating a document into a secret language that only you and trusted recipients can understand, except the "language" is a complex mathematical algorithm rather than a simple code.

A cryptographic algorithm defines the exact process for this transformation. It specifies how to combine your original information—called plaintext—with a predetermined key to produce scrambled output called ciphertext. The beauty of this system lies in its reversibility: with the correct key, the algorithm can transform the ciphertext back into the original plaintext through a process called decryption.

The security of this entire system depends on the keyspace—the total number of possible keys that could be used with a particular algorithm. If an algorithm uses 128-bit keys, for example, there are 2^128 possible key combinations. That's approximately 340 trillion trillion trillion different keys. Even if an attacker could test one billion keys per second, it would take them longer than the age of the universe to try every possible combination. The larger the keyspace, the longer it takes an adversary to discover the correct key through random guessing.

Cryptographic algorithms fall into two major categories based on their key structure. Symmetric encryption algorithms use the same key for both encryption and decryption—like a house key that both locks and unlocks the front door. Asymmetric encryption algorithms use two different keys: one to encrypt information and a mathematically related but different key to decrypt it. For protecting files at rest, symmetric encryption is typically preferred because it's faster and requires less computational overhead.

Algorithms also differ in how they process information. Block encryption handles data in fixed-size chunks called blocks, typically 128 bits (16 bytes) at a time. The algorithm takes each block of plaintext, applies the cryptographic transformation using the key, and produces a corresponding block of ciphertext. Stream encryption processes data continuously, one bit or byte at a time, producing output as soon as input arrives. Block ciphers like AES are more common for file encryption because they can handle data of any size by processing it block by block.

The relationship between plaintext, key, and ciphertext forms the foundation of all encryption. Your original data (plaintext) passes through the algorithm along with your secret key, producing scrambled output (ciphertext) that appears random to anyone without the key. When you need to access the data later, you reverse the process: the same algorithm uses the same key to transform the ciphertext back into readable plaintext. This mathematical relationship ensures that encryption and decryption are precise and reliable—there's no guesswork or approximation involved.

Apply Symmetric Encryption Algorithms to Encrypt and Decrypt Data (5.3.B)

The most widely used symmetric encryption algorithm in the world is the Advanced Encryption Standard (AES). If you've ever connected to a WPA3-secured Wi-Fi network, made an online purchase, stored files in cloud storage, or used a smartphone, you've relied on AES encryption. It secures everything from your internet browsing sessions to the contents of your encrypted hard drive, making it the de facto standard for protecting data across virtually every digital platform.

AES is a symmetric key block cipher, meaning it uses the same key for encryption and decryption, and it processes data in fixed-size blocks of 128 bits (16 bytes). One of AES's strengths is its flexibility with key lengths: it can operate with 128-bit, 192-bit, or 256-bit keys. Longer keys create exponentially larger keyspaces and thus provide stronger security, but they also require more computational time to encrypt and decrypt data. For most applications, AES-256 (using 256-bit keys) provides security that's practically unbreakable with current technology.

Understanding AES in practice means knowing how to use the tools that implement it. You have several options for encrypting and decrypting files with AES: command-line interfaces like OpenSSL, specialized software like AES Crypt, or web-based tools for quick experiments. Each approach has its place, but command-line tools like OpenSSL offer the most control and are essential skills for anyone working in cybersecurity.

Let's examine how OpenSSL commands work in practice. When you want to encrypt a file called test using AES with a 128-bit key, you use this command:

openssl enc -aes-128-cbc -e -in test -k password -out test.enc

Breaking this down: enc tells OpenSSL to perform encryption or decryption, -aes-128-cbc specifies the algorithm (AES) with key length (128 bits) and mode (CBC, or Cipher Block Chaining), -e indicates encryption, -in test identifies the input file, -k password provides the password from which the encryption key will be derived, and -out test.enc specifies the output file that will contain the encrypted data.

To decrypt that same file, you reverse the process:

openssl enc -aes-128-cbc -d -in test.enc -k password -out test

The only differences are -d for decryption instead of -e for encryption, and the input/output files are swapped. The same password derives the same key, ensuring that decryption reverses the encryption perfectly.

Here's a practical scenario to illustrate the process: imagine you have a file called financial_records.txt containing sensitive banking information. You want to encrypt it before uploading to cloud storage. First, you encrypt:

openssl enc -aes-256-cbc -e -in financial_records.txt -k MySecure2024Pass! -out financial_records.enc

The original readable file gets transformed into financial_records.enc, which contains only random-looking binary data. You can safely upload this encrypted file to any cloud service—even if attackers intercept it, they see only meaningless ciphertext. When you need to access your records later, you download the encrypted file and decrypt it:

openssl enc -aes-256-cbc -d -in financial_records.enc -k MySecure2024Pass! -out financial_records.txt

Your original data emerges intact and readable. The key insight is that the security depends entirely on keeping your password secret. The algorithm and ciphertext can be completely public—in fact, the strength of AES comes from its openness to scrutiny—but the password must remain confidential.

CONFIDENTIAL FINANCIAL INFORMATION

Bank Account: 123-456-7890
Balance: $45,000.00
SSN: 123-45-6789
Credit Score: 750

This file contains sensitive financial data that should be encrypted before storage or transmission.

One important consideration when using OpenSSL is that the encryption key is derived from the password you provide. OpenSSL uses a key derivation function to convert your human-readable password into the binary key that AES actually uses. This means that password strength directly affects encryption security—even with AES-256's massive keyspace, a weak password creates a vulnerable point that attackers can exploit through password-guessing attacks.

The practical implications extend beyond individual file protection. Understanding symmetric encryption prepares you to make informed decisions about disk encryption tools like BitLocker or FileVault, secure communication applications, and enterprise data protection systems. All of these tools rely on the same fundamental principles you've explored: mathematical algorithms, secret keys, and the transformation between plaintext and ciphertext.

Real-World Application

Consider a healthcare organization that needs to protect patient records stored on laptops used by mobile medical staff. Using AES encryption, they can ensure that even if a laptop is lost or stolen, the protected health information (PHI) remains secure and compliant with HIPAA regulations. The same technology protects financial data in banking applications, intellectual property in corporate environments, and personal information in consumer devices. The ubiquity of AES encryption demonstrates how essential symmetric cryptography has become to modern digital security.

Further Reading & Resources

• NIST Special Publication 800-175B: Guideline for Using Cryptographic Standards
• OpenSSL Documentation: Symmetric Encryption
• SANS Institute: Introduction to Cryptography
• AES Crypt: Open Source File Encryption
• Cryptography Engineering by Ferguson, Schneier, and Kohno

References

• NIST FIPS 197: Advanced Encryption Standard (AES)
• OpenSSL Project Documentation
• SANS White Paper: Introduction to Cryptography