Chapter 6 — Encryption, Authentication & Security
Master the fundamentals of network security for the HKDSE ICT exam. Learn encryption technologies, authentication methods, and security measures with practical examples.
Encryption, decryption, keys, and security fundamentals
Authentication methods, smart cards, and security protocols
Real-world security measures and implementations
Test your understanding with 12 questions
20 key terms with definitions and examples
Practice with exam-style questions
Encryption is the process of transforming readable data (plaintext) into an unreadable form (ciphertext) using an encryption key. This protects data from eavesdropping and unauthorized access.
Decryption is the reverse process — transforming ciphertext back into plaintext using a decryption key.
Example:
Plaintext: "I love ICT so much"
↓ (Encryption with key)
Ciphertext: "Lsoryh $LFW Svr$pxfk"
↓ (Decryption with key)
Plaintext: "I love ICT so much"
An encryption key is a piece of information used in the encryption algorithm to transform plaintext into ciphertext. The key is also needed for decryption.
Key Size refers to the length of the encryption key, measured in bits (e.g., 128-bit, 256-bit). Larger keys provide stronger security because they have more possible combinations, making brute-force attacks much harder.
| Key Size | Security Level | Notes |
|---|---|---|
| 64-bit | Weak | Easily cracked, not recommended |
| 128-bit | Strong | Commonly used, secure for most purposes |
| 256-bit | Very Strong | Military-grade security, extremely difficult to crack |
Symmetric key encryption (also called private key encryption) uses the same key for both encryption and decryption.
Symmetric Key Process: Sender Receiver | | | Plaintext: "Hello" | | + Shared Key: "ABC123" | | ↓ Encrypt | | Ciphertext: "X8$mQ" | |----------------------------------------->| | | Ciphertext: "X8$mQ" | | + Shared Key: "ABC123" | | ↓ Decrypt | | Plaintext: "Hello"
Eavesdropping is when an unauthorized person intercepts data during transmission. Encryption protects against this by making the intercepted data unreadable without the decryption key.
How encryption protects users:
Authentication is the process of verifying the identity of a user, device, or system. It ensures that only authorized individuals can access protected resources.
Common authentication methods:
| Method | Advantages | Disadvantages |
|---|---|---|
| Password | Easy to implement, no special hardware needed | Can be forgotten, stolen, or guessed |
| Smart Card | Physical token, harder to steal remotely | Can be lost or stolen, requires card reader |
| Biometrics | Unique to individual, cannot be forgotten | Expensive hardware, privacy concerns |
| 2FA | Very secure, combines multiple methods | More complex, requires multiple steps |
A smart card is a physical card with an embedded microchip that stores encrypted information or the private key of the cardholder. It is a type of hard token used for authentication.
How smart cards work:
Examples of smart cards in Hong Kong:
Electronic transactions (e.g., online shopping, banking) require multiple security measures to protect users:
Security technology continues to evolve. Recent trends include:
Online banking systems use multiple layers of security:
Many Hong Kong schools use smart card systems for access control:
Online shopping platforms implement comprehensive security measures:
Protecting sensitive information in email communications:
Mobile payment apps (Alipay, WeChat Pay, Apple Pay) use advanced security:
Click on any card to flip and see the definition
Plaintext is the original, readable data before encryption. Ciphertext is the encrypted, unreadable data after encryption.
Example:
Plaintext: "I love ICT so much"
Ciphertext: "Lsoryh $LFW Svr$pxfk"
Explanation: Encryption transforms plaintext into ciphertext using an encryption key. Without the correct decryption key, the ciphertext cannot be read, protecting the information from unauthorized access.
A 256-bit key is more secure than a 128-bit key because it has exponentially more possible combinations (2^256 vs 2^128). This makes brute-force attacks (trying all possible keys) virtually impossible with current computing power.
Detailed explanation:
• 128-bit key: 2^128 ≈ 340 trillion trillion trillion combinations
• 256-bit key: 2^256 ≈ 115 quattuorvigintillion combinations
• The larger the key size, the longer it takes to crack through brute force
• 256-bit encryption is considered military-grade security
How it works: Symmetric key encryption uses the SAME key for both encryption and decryption. The sender encrypts data with the key, and the receiver decrypts it using the same key.
Advantage: Fast and efficient for encrypting large amounts of data. Requires less computational power than asymmetric encryption.
Disadvantage: The key must be securely shared between sender and receiver. If the key is intercepted during transmission, security is compromised. This is known as the "key distribution problem."
Examples: AES (Advanced Encryption Standard), DES (Data Encryption Standard)
Definition: A smart card is a physical card with an embedded microchip that stores encrypted information or the private key of the cardholder. It is a type of hard token used for authentication.
Hong Kong Examples:
1. New Smart Hong Kong ID Card: Used for identity verification, immigration clearance, and accessing government services
2. Octopus Card: Used for electronic payment in public transport, retail stores, and access control in schools and residential buildings
Authentication Process:
1. User inserts the smart card into a card reader
2. The card reader communicates with the chip on the card
3. The system verifies the encrypted information or private key stored on the chip
4. If the information is valid, access is granted
Comparison:
| Method | Security | Convenience | Cost |
|---|---|---|---|
| Password | Low-Medium (can be guessed/stolen) | High (easy to use) | Low (no hardware needed) |
| Smart Card | Medium-High (physical token) | Medium (need to carry card) | Medium (card + reader needed) |
| Biometrics | High (unique to individual) | Very High (no need to remember/carry) | High (expensive hardware) |
Recommendation: For high-security online banking, I recommend Multi-Factor Authentication (MFA) combining password + SMS OTP + biometrics (fingerprint/face recognition).
Justification:
• Passwords alone are vulnerable to phishing and keyloggers
• Adding SMS OTP provides a second factor ("something you have" - your phone)
• Biometrics add a third factor ("something you are") that cannot be stolen or forgotten
• This layered approach ensures that even if one factor is compromised, the account remains protected
• Most major banks now use this approach for high-value transactions
• The slight inconvenience is justified by the significantly enhanced security for financial data
Five Security Measures:
Conclusion: Implementing multiple layers of security (defense in depth) ensures that if one measure fails, others still protect customer data. This comprehensive approach is essential for maintaining customer trust and complying with data protection regulations.