Common Backend Vulnerabilities
Authentication & Authorization
Spring Security JWT authentication
In an era of constant cyber threats and data breaches, robust application security relies on cryptographic techniques and tools to ensure both confidentiality and integrity in compliance with regulatory standards. People often mixing the terms "hashing" and "encryption" when talking about cryptography, but they are fundamentally different and serve distinct purposes. Choosing the wrong one can lead to a major security vulnerability.
Data encryption is a security process that converts readable data (plain-text) into an unreadable code, known as cipher-text, using a specific algorithm and a secret key. This ensures that only authorized individuals with the correct key can decipher the information, protecting sensitive data from unauthorized access, both when it is being stored and when it is being transmitted.
Data encryption works by applying a mathematical algorithm, along with a secret key, to transform the original plaintext data into an unreadable cipher-text. The same key is then used to then reverse the process, “decrypting the cipher-text,” and revealing the original plaintext. Without the correct key, the cipher-text remains unintelligible and thus inaccessible to unauthorized individuals.
There are two broad categories of data encryption: symmetric and asymmetric encryption. Both have their own strengths and weaknesses and are used for different purposes.
Symmetric encryption uses the same key for both encryption and decryption processes. It’s quicker and less demanding on resources, ideal for encrypting large data volumes.
https://www.youtube.com/watch?v=r3JX6sLA9XI
Also known as public-key encryption, asymmetric encryption uses two keys: one for encryption and another for decryption. The data is encrypted with the public key, and its decryption is facilitated by the private key. This process eliminates the need to share keys, thereby increasing security, but it’s more demanding on resources than symmetric encryption.
http://www.youtube.com/watch?v=9ukUYMcEh3Y
<aside> 💭
The type of encryption chosen depends on the specific needs and resources of the situation.
</aside>
Data encryption algorithms convert plaintext data into ciphertext, ensuring data confidentiality and integrity. Each method has a compelling use case and times when it is not sufficient. Before implementing one into your business, consider how each might benefit or hinder your data privacy goals.
Implementing data encryption involves three main challenges. First, complex key management is required to securely generate, store, and rotate cryptographic keys, as improper handling can make the encryption worthless. Second, encryption can create a performance impact, slowing down systems and forcing a trade-off between security and application speed. Finally, organizations face the difficulty of ensuring compliance with diverse and evolving industry and regional data protection regulations.
Hashing is a one-way cryptographic process that transforms any input data into a fixed-size string of characters, known as a hash value or digest. Unlike encryption, which is a two-way process designed to be reversed (decrypted), hashing is irreversible. You cannot retrieve the original data from its hash. The primary purpose of hashing is not to hide data, but to verify its integrity and authenticity. By comparing the hash of a piece of data at two different points in time, you can instantly know if it has been altered in any way.
Hashing works by feeding data of any size—from a single word to a large file—into a mathematical hash function. This function processes the input and produces a unique, fixed-length output. For example, the SHA-256 algorithm will always produce a 256-bit (64-character) hash, regardless of whether the input is "hello" or the entire text of a book.
The process is deterministic, meaning the same input will always generate the exact same hash value. However, a tiny change in the input (like changing a single letter) will produce a completely different hash.
https://www.youtube.com/watch?v=QZY3IjFBtFY
A secure hashing algorithm is built on several key principles:
Just like with encryption, different hashing algorithms have been developed over the years, with varying levels of security.
Hashing is a workhorse in modern computing and is used in many scenarios:
| Feature | Encryption | Hashing |
|---|---|---|
| Purpose | Confidentiality (to keep data secret) | Integrity (to verify data hasn't changed) |
| Function Type | Two-way (Encrypt & Decrypt) | One-way (Irreversible) |
| Output | Variable length (related to input) | Fixed length |
| Key | Requires a secret key to reverse | No key is used |
| Primary Use Case | Securing data in transit and at rest | Storing passwords, verifying file integrity |
Now that we understand the fundamental difference and know that hashing is the correct tool for passwords, let's explore how to do it correctly.
This short video explains one of the concepts we learned in this chapter - Hashing
https://www.youtube.com/watch?v=yoMOAIzBSpY
The HackYourFuture curriculum is licensed under CC BY-NC-SA 4.0 *https://hackyourfuture.net/*
Built with ❤️ by the HackYourFuture community · Thank you, contributors
Found a mistake or have a suggestion? Let us know in the feedback form.