Common encryption standards
RSA (Rivest–Shamir–Adleman) An asymmetric encryption algorithm, one of the earliest and most widely used. Its security relies on the mathematical difficulty of factoring the product of two large prime numbers. RSA is used for secure key exchange, encryption, and digital signatures, and is notable for allowing operations in both directions (public key ↔ private key). It’s computationally slower than symmetric algorithms and typically requires large key sizes (2048 bits or more) for strong security.
AES (Advanced Encryption Standard) A symmetric encryption algorithm and the current global standard, adopted in 2001 to replace DES. It supports key sizes of 128, 192, or 256 bits, encrypting data in 128-bit blocks through multiple rounds of substitution and permutation. AES is fast, efficient, and considered highly secure – used everywhere from Wi-Fi (WPA2/3) to file encryption to TLS (HTTPS).
ECC (Elliptic Curve Cryptography) An asymmetric encryption approach based on the mathematics of elliptic curves rather than prime factorisation. It achieves the same level of security as RSA but with much smaller key sizes (e.g. a 256-bit ECC key is roughly as secure as a 3072-bit RSA key), making it faster and more efficient – suited to mobile devices and modern TLS connections. ECC is typically implemented through specific schemes like key exchange (ECDH) and digital signatures (ECDSA) rather than general encrypt/decrypt operations.
Quick summary:
| Algorithm | Type | Common Use |
|---|---|---|
| DES | Symmetric | Obsolete (see early methods and weaknesses) |
| AES | Symmetric | Bulk data encryption (current standard) |
| RSA | Asymmetric | Key exchange, signatures, encryption |
| ECC | Asymmetric | Key exchange, signatures (modern, efficient) |
WPA2/WPA3 (Wi-Fi Protected Access) explainer
Summary:
- Both the Wifi Access Point and your computer/phone know the password
- There is a handshake process where the password is not transmitted, but the process proves that both parties know the same password.
- WPA uses AES (symmetric encryption) to protect data once connected.
You don’t need to know what’s below, but it may help to understand the concept
WPA2:
- Authentication (4-way handshake) When a device tries to connect, the router and device perform a “4-way handshake” to confirm the device knows the correct network password (Pre-Shared Key/PSK), without ever sending the actual password over the air.
- Key generation From this handshake, both sides derive a unique session key used to encrypt traffic between that device and the router.
- Encryption Data is then encrypted using AES (with the CCMP protocol), the same symmetric encryption standard discussed earlier – fast and secure for ongoing data transfer.
Weakness: WPA2’s handshake can be captured by an attacker and attacked “offline” – they can try guessing passwords against the captured handshake without needing to be actively connected, making weak/common passwords vulnerable (this is known as a KRACK-style or offline dictionary attack).
WPA3:
WPA3 improves on this mainly by changing how the initial connection and password verification happens:
- SAE (Simultaneous Authentication of Equals) Replaces the old 4-way handshake with a more secure method (based on a technique called “Dragonfly handshake”). Crucially, this prevents offline password-guessing attacks – an attacker can’t capture anything useful to brute-force later; they’d have to guess in real-time, one attempt at a time, which is far slower and easier to detect.
- Forward secrecy Even if an attacker later discovers the password, they can’t decrypt previously captured traffic, because each session generates unique encryption keys.
- Stronger encryption WPA3 uses AES with a longer key (192-bit in WPA3-Enterprise mode) for higher security in sensitive environments.