Symmetric Encryption Algorithms - Their Strengths and Weaknesses, and the Need for Crypto-Agility

In this article, the second in a 3-part series on symmetric key encryption technology, we look at the development of symmetric key encryption algorithms and the range of algorithms available today along with their strengths and weaknesses, as well as the importance of crypto-agility.

Read more

What is a Crypto-Abstraction Layer?

A crypto-abstraction layer (CAL) is, in its most general sense, an application programming interface (API) - also known as a library- that hides cryptographic details from program developers that they don’t need to know about (such as the brand of hardware they are using for their source of random numbers). They are essential in the world of InfoSec because those who are expert developers are not usually expert cryptographers or even security personnel and so they need all the help they can get when it comes to implementing cryptography.

Read more

What is Crypto-Agility?

Crypto-agility, or cryptographic agility, is the capacity for an information security system to adopt an alternative to the original encryption method or cryptographic primitive without significant change to system infrastructure. NIST guidelines state “maintaining crypto agility is imperative” to prepare for the quantum computing era. Crypto-agility may be achieved through the adoption of new frameworks for incident response and application development, as well as the acquisition of a service software layer to facilitate crypto-agility in legacy applications.

Read more

3DES is Officially Being Retired

According to draft guidance published by NIST on July 19, 2018, the Triple Data Encryption Algorithm (TDEA or 3DES) is officially being retired. The guidelines propose that, after a period of public consultation, 3DES is deprecated for all new applications and usage is disallowed after 2023.

Read more

Cryptographic Key Management - the Risks and Mitigation

With the increasing dependence on cryptography to protect digital assets and communications, the ever-present vulnerabilities in modern computing systems, and the growing sophistication of cyber attacks, it has never been more important, nor more challenging, to keep your cryptographic keys safe and secure. A single compromised key could lead to a massive data breach with the consequential reputational damage, punitive regulatory fines and loss of investor and customer confidence.

Read more

Quantum Computing and its Impact on Cryptography

“Quantum computing” is computation performed using a computing device based on the strange, counter-intuitive physical properties of matter at very small scale, known as quantum mechanics.

Read more

Classification of Cryptographic Keys

This article is intended as a primer on the classification of cryptographic keys used for securing digital applications.

Read more

PKI for EMV cards compliant to PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard to prevent credit card scams and numerous additional security threats & vulnerabilities.

Read more