A Simple Introduction to Asymmetric Encryption
by Emin Khateeb, Front-end Developer at Bitcoin Suisse
80% of hacking-related breaches are still tied to passwords. According to a recent report on data breaches, 1509 incidents, 448 with confirmed data disclosure, have occurred in the financial industry.
These numbers clearly indicate that cyber security continues to be a major issue around the world and in financial services in particular. But even as potential threats multiple, there are some simple measures which can help keep systems and users secure.
One of these is the use of Asymmetric Encryption for user data — a method which we also employ at Bitcoin Suisse. While some of the finer points of encryption might be hard to understand — we take the opportunity here to give a simple overview and help show you, our customers, how we work to protect you on a regular basis.
Let’s zoom in to look at Asymmetric Encryption and see how it works.
What does Asymmetric Encryption do?
Everything that is being transmitted over a network can be inspected and manipulated. But to do so, there are several barriers already baked into modern web browsers that an attacker would need to overcome before being able to access or change the data. One of these barriers is SSL, which is activated when you visit websites using the https protocol. For this reason, you see the hint below on the Bitcoin Suisse Online platform:
SSL uses the process of Asymmetric Encryption to make the data transmitted essentially unreadable for an attacker. This means that every time you log into your Bitcoin Suisse Online account, you are travelling through a secure connection to place your orders, view market data and track your holdings. This is built-in — it works in the background (as good security should).
How it works
While this article will keep things high level, it might be helpful to use a metaphor to help explain how the process of Asymmetric Encryption works.
We can imagine Jennifer and Max, two fictitious persons that like to share secrets with each other, but not so much with the rest of the world.
To do so, they use a box and two locks. Jennifer holds the key that can open Max’s lock and Max holds the key for Jennifer’s lock. When Max wants to share a secret with Jennifer, he puts it in that box and locks it with the lock that only Jennifer has the key to it. Not even Max himself can open it after locking it. So Jennifer can now unveil the secret by unlocking the lock and opening the box. If she wants to share a secret with Max, she can do the same by using the lock to which only Max has the key.
Asymmetric Encryption follows the same principle, but instead of using a box for the secret, it encrypts the information using a cryptographic algorithm. The lock and the key are the so-called key-pair, consisting of the public and private key. As the names imply, the public key can be shared freely and without fear, because it can only be used to encrypt the data. While only the private key can decrypt this data.
If we now adapt this principle to how the web browser interacts with the server, we have already discovered how the process works. All data that you pass to the server, e.g. your login credentials, is encrypted with the public key and only the server can read it by decrypting that same information with the private key.
Conclusion
If these principles sound familiar, it’s because public-private key encryption is also a key aspect of the blockchain and of cryptocurrencies.
This makes the entire topic of special importance to us at Bitcoin Suisse — which is why we take serious measures to use encryption ourselves, for the benefit of our clients and the industry as a whole.
Originally published at https://www.bitcoinsuisse.com on October 14, 2020.
