Cracking the Code: A Comprehensive Guide to Data Encryption Algorithms

12 min readOct 19, 2023

In the realm of modern security, data encryption algorithms are the cornerstone, essential for fortifying our data against breaches. These algorithms are powerful guardians of our personal data, financial records, and intellectual property. They ensure that whether our information is stored on devices, transferred online, or maintained in the cloud, it remains protected from unauthorized access. These are mathematical formulas employed to obfuscate data, rendering it indecipherable to those without authorization. Technically, encryption involves converting easily readable plaintext into cryptic ciphertext. In simpler words, encryption turns legible data into seemingly random information. To achieve this, cryptographic keys are utilized — mathematical values mutually agreed upon by the sender and receiver of an encrypted message. These keys serve to safeguard data from unauthorized access, alteration, disclosure, or deletion

Two Core Types of Data Encryption Algorithms

Symmetric algorithms: These algorithms use the same key to encrypt and decrypt data. This means that both parties must have the same key in order to communicate securely. Some examples of symmetric algorithms include Advanced Encryption Standard (AES), Data Encryption Standard (DES), Triple Data Encryption Standard (3DES), Blowfish, and Twofish.
Asymmetric algorithms: These algorithms use two different keys: a public key and a private key. The public key is made public, while the private key is kept private. This implies that anyone with the public key can encrypt data, but only the person with the private key can decrypt it. Some examples of asymmetric algorithms include Rivest-Shamir-Adleman (RSA), Elliptic Curve Cryptography (ECC), and Diffie-Hellman key exchange (DH).

Advanced Encryption Standard (AES)

AES is considered to be one of the most secure encryption algorithms in the world and is used by governments and businesses around the world to protect sensitive data. It has been subjected to extensive cryptanalysis, and no significant weaknesses have been found. To encrypt data, AES employs a substitution-permutation network (SPN). An SPN is a set of connected operations that include replacing inputs with particular outputs (substitutions) and bit shuffling (permutations).

The specific operations used in AES are:

1. Sub Bytes: This operation implements substitution by replacing each byte in the input block with another byte that is chosen from a substitution table (S-box). This substitution is done in such a way that a byte is neither substituted by itself nor by the complement of the current byte. The result of this step is a 16-byte (4 x 4) matrix like before.

2. Shift Rows: This operation implements the permutation and cyclically shifts the rows of the input block by a certain number of positions. For example, in the left circular shift for a 4x4 matrix, the first row has no shift, the second row has one shift to the left, the third row has two shifts to the left, and the fourth row has three shifts to the left.

3. Mix Columns: This operation implements permutation and mixes the columns of the input block using a series of mathematical operations. It is basically matrix multiplication, where each column is multiplied by a specific matrix, and the position of each byte in the column changes as a result. This step is skipped in the last round.

4. Add Round Key: This operation XORs the resultant output of the previous stage with the corresponding round key. The round keys are generated from the original key using a key schedule algorithm. The key schedule algorithm ensures that the round keys are different, which makes it more challenging to decrypt data. If this is the final round, the resulting state array is used as the ciphertext for the specified block; otherwise, it serves as the new state array input for the following round. In this case, the 16 bytes are merely 128 bits of data and not a grid.

The AES algorithm repeats these operations a certain number of times, depending on the length of the key. For a 128-bit key, the algorithm has 10 rounds; for a 192-bit key, it has 12 rounds; and for a 256-bit key, it has 14 rounds. Once the encryption process is complete, the ciphertext is generated, and the ciphertext can then be decrypted using the same key and algorithm.

Data Encryption Standard (DES)

Data Encryption Standard (DES) was developed by IBM in the late 1970s and adopted as a standard by the National Institute of Standards and Technology (NIST) in 1977. DES is a very secure algorithm that encrypts data using a 56-bit key, but it has been shown to be vulnerable to brute-force attacks. The DES algorithm is made up of 16 rounds of operations. Each round consists of a series of transformations, including substitution, permutation, and XOR operations. DES is a very widely used algorithm. It is used to encrypt data in a variety of applications, including file encryption, database encryption, and network encryption.

The specific operations used in AES are:

Expansion: Using expansion permutations, the half-block of 32 bits is enlarged to a length of 48 bits.
Key mixing: For each round, this data is subjected to an XOR operation with 16 subkeys of 48-bit length.
Substitution: The resultant block is further divided into smaller blocks of 6 bits and processed with the Substitution box, which generates a nonlinear transformation of the input data using a lookup table for the S-box.
Permutation: The output is rearranged using a fixed permutation using the P-box.

Actually, the initial key is really 64 bits long. However, before the DES process begins, every eighth bit of the key is discarded, yielding a 56-bit key. That is, bit positions 8, 16, 24, 32, 40, 48, 56, and 64 are discarded. The broad steps in DES are as follows:

The 64-bit plain text block is sent to an initial permutation (IP) function.
The IP function produces two halves of the permuted block, called the Left Plain Text (LPT) and the Right Plain Text (RPT).
The encryption operation is repeated 16 times for each LPT and RPT.
In each round, the LPT and RPT are combined with a round key using an exclusive-or (XOR) operation.
The LPT and RPT are then passed through a series of substitution and transposition operations.
After 16 rounds, the LPT and RPT are re-joined.
The combined LPT and RPT block is subjected to a final permutation (FP).
The result of the FP operation is the 64-bit ciphertext.

Triple Data Encryption Standard (Triple DES)

Triple DES (3DES) is a symmetric-key block cipher that uses the DES cipher method for each data block three times. The original DES cipher’s key size of 56 bits was generally sufficient when that algorithm was designed, but the availability of increasing computational power made brute-force attacks feasible. Triple DES provides a relatively simple method of increasing the key size of DES to protect against such attacks without the need to design a completely new block cipher algorithm.

The Triple DES encryption process works as follows:

The plaintext is encrypted using the first key (K1).
The ciphertext is decrypted using the second key (K2).
The plaintext is encrypted using the third key (K3).

The resulting ciphertext is 168 bits long, which is significantly more secure than the original 64-bit DES ciphertext. However, it is important to note that Triple DES is still vulnerable to certain types of attacks, such as meet-in-the-middle attacks.

Blowfish

Blowfish is an encryption technology created in 1993 by Bruce Schneier as an alternative to the DES Encryption technology. It is substantially quicker than DES and has a high encryption rate with no successful cryptanalysis techniques discovered to yet. It is one of the earliest secure block cyphers that is not subject to patents and hence freely available for use by anybody.

The broad steps in Blowfish are as follows:

As Blowfish uses an SP network, firstly it initiates the substitution box (S-box) and permutation box (P-box/Pi). There are a total of 18 P-box entries.
It split 64-bit plaintext into two equal blocks, L and R.
The encryption loop runs 16 times and in each loop the following steps take place:

XOR L with Pi, where ‘i’ depends on the loop’s current iteration.
XOR R with F, where F is a function (as shown in the figure below) of L that makes use of the S-box split into 4 blocks.
Finally, L and R are swapped before the loop enters its next iteration.
After the loop finishes, L and R are swapped once more.
Next, last two unused P-box entries are used by XORing R with P17 and L with P18.
Finally, L and R are combined to retrieve the ciphertext.

Twofish

The Twofish algorithm is made up of 16 (r) rounds of operations. Each round consists of a series of transformations, including substitution, permutation, and XOR operations. The transformations are designed to be very difficult to reverse, which makes Twofish a very secure algorithm. Similar to Blowfish, Twofish is a Feistel network and thus has an F function which is applied to the data input block and consists of several operations, including S-boxes, MDS matrices, and PHT.

S-boxes (Nonlinear substitution boxes): They are used to substitute a different byte for each byte in the input block. The S-boxes are meant to be extremely difficult to invert, making it impossible for an attacker to decrypt the data.
The MDS matrix (4x4 matrix): It is used to diffuse the data. Diffusion is the method through which information in data spreads throughout the block. This makes identifying patterns in the data more challenging for an attacker.
PHT permutation function (Pseudo-Hadamard Transform): It is used to reorder the bytes in a block., as it makes more difficult for an attacker to determine the relationship between the F function’s input and output.

Additionally, input whitening occurs when the input data block is XORed with the first round key in order to mix the data with the key. Similarly, output whitening occurs when the F function output is XORed with the second round key in order to mix the data with the key.

The broad steps in Twofish are as follows::

The plaintext is divided into blocks of 64 bits.
The first block of plaintext is encrypted using the 128-bit key.
The encrypted block of plaintext is then XORed with the next block of plaintext.
The process is repeated for each subsequent block of plaintext.
The final encrypted block of plaintext is the ciphertext.

Rivest-Shamir-Adleman (RSA)

RSA is a very secure algorithm, and it has not been shown to be vulnerable to any known attacks. As a result, RSA is a very popular algorithm, and it is used in a variety of applications, including secure email, file encryption, and digital signatures. The two broad components of RSA cryptography are as follows:

Key Generation: The keys are generated to be used for encrypting and decrypting the data to be exchanged.
Encryption/Decryption: The steps are run when scrambling and recovering the data.

The broad steps in RSA are as follows:

For key generation:

Choose two large prime numbers (p and q) and calculate the value of ’n’ and ‘z’: n=p*q and z=(p-1)(q-1)
Choose a number E where 1 < E < z and calculate D = E-1 mod z
Bundle private and public key pair as (n, D) and (n, E) respectively.

Encryption/Decryption Function:

If the plaintext is M, it is converted to a number H# and ciphertext = H#E mod n.
If the ciphertext is CT, plaintext = CTD mod n

RSA algorithm depends on the difficulty of factoring large numbers. If an attacker knows the two prime numbers, they can factor the product and calculate the private key. However, this is a very difficult problem to solve, and it is not currently possible to factor in large numbers quickly.

Elliptic Curve Cryptography (ECC)

Elliptic Curve Cryptography (ECC) is a public-key cryptography algorithm that is based on the algebraic properties of elliptic curves. It is a very secure algorithm, and it is becoming increasingly popular because it is more efficient than some other public-key cryptography algorithms, such as RSA. ECC is a very secure algorithm, and it has not been shown to be vulnerable to any known attacks. As a result, ECC is used in a variety of applications, including secure email, file encryption, and digital signatures.

Here is how ECC works:

Two elliptic curves are chosen, and a point on each curve is chosen.
A function is used to generate a public key and a private key from the two points.

The public and private keys are used to encrypt and decrypt data, respectively.

Image Source: https://www.techtarget.com/searchsecurity/definition/elliptical-curve-cryptography

The ECC algorithm is based on the difficulty of solving the discrete logarithm problem for the elliptic curve. An attacker can solve the elliptic curve discrete logarithm problem and determine the private key if they know the two points. However, this is a very tough problem that cannot be solved rapidly at the moment.

Diffie-Hellman (DH) Key Exchange

The Diffie-Hellman key exchange method allows two parties to agree on a shared secret key while communicating through an unsecured channel. It is a key-exchange protocol, which means it is used to generate a shared secret key, which is then used to encrypt future conversations. The Diffie-Hellman key exchange algorithm is a very secure algorithm, and it has not been shown to be vulnerable to any known attacks. As a result, it is a very popular algorithm, and it is used in a variety of applications, including secure email, file encryption, and virtual private networks (VPNs).

A step-by-step explanation of the Diffie-Hellman key exchange algorithm with an example of two users:

Consider 4 variables, one prime P and G (a primitive root of P) and two private values a and b.
P and G are both publicly available numbers.
Users (say, Alice and Bob) choose private values a and b, construct a key, and publicly exchange them.
The opposite person receives the key, which produces a secret key, and they both have the same secret key S to encrypt with.
S is the shared secret key. Alice and Bob can now use K to encrypt and decrypt subsequent communications.

Comparison: Data Encryption Algorithms

Conclusion

Data encryption algorithms play a crucial role in safeguarding our digital information. Understanding the array of available algorithms and selecting the most suitable one for specific needs is vital to ensure data remains shielded from unauthorized access. The algorithms outlined in this article represent just a fraction of the choices at hand. Given the multitude of options, careful research is pivotal in making the right selection.

When opting for a data encryption algorithm, one must weigh factors such as security level, performance demands, and compatibility prerequisites. Through a comprehensive assessment of these aspects, the optimal data encryption algorithm can be identified to suit specific requirements. Embrace the power of top-tier data encryption algorithms to fortify your data’s protection.

Cracking the Code: A Comprehensive Guide to Data Encryption Algorithms