Digital Signing and Encryption

Security is key for internet business and communications. As most business involves an online element, especially now with the rapid movement to remote home working, the ability to trust that transactions and data flows are secure needs to be taken for granted by users. The way to ensure security depends on what is being secured, and on what the desired outcome is. The pillars of online security are:

• Secure network connectivity - provided by using TLS (née SSL) to encrypt the connections between devices and web applications.
• Secure data transfers - also provided by TLS to encrypt data as it moves over a network connection.
• Secure data at rest - encryption of data at rest on devices, on servers, and in the Cloud.
• Secure user identification - making sure that people are who they claim to be—both for system login and for data sending.

All four items on this list are important, and they are related via how they are implemented using trusted digital certificates. In this article, we will look at how digital certificates and public key infrastructure (PKI) are used to deliver encryption and digital signing.

Digital signing and encryption are often thought off as the same thing. This is understandable as there are closely related, but there are subtle differences. Both use digital certificates and associated public and private PKI digital keys to apply security to online activities:

• Encryption - One digital key (usually a private key - but not always) is used to encrypt a data connection or file. Any receiver of the data connection or file uses the public key associated with the private key to decrypt the data.
• Digital signing - a message to be sent is signed with the digital certificate key before it is sent to recipients. Note this is not just adding a copy of a written signature image to a message, nor is it encrypting the data in the message. Anyone who receives the message can read the contents (as it’s not encrypted), but they can also verify that the message is legitimately from the sender in question and that the contents have not been changed. This is often used when you want to confirm the legitimate author of a message, but the contents are not confidential.

Often encryption and digital signing will both be used. But they don’t have to be. Encryption protects the data, and digital signing guarantees the integrity of the sender. Both are not restricted to simple messages or files. Any data that is being moved from one point to another can, and should, be protected with digital signing and/or encryption.

Implementing PKI for your organisation

Renaissance and our vendor partner network live and breathe IT security. Including all aspects of encryption and digital signing. Whatever the size of an organisation or the security required, we can analyse, design, and deploy a solution to secure every aspect of a digital workflow. Contact us today to discuss your needs and find out more about the solutions available.