With symmetric encryption, you have one key that is used for the same encryption and decryption. You can think of it as a door in the analogue world. Sender and receiver agree on the key together or exchange it.
Advantages of symmetric encryption are:
- Speed: Large data sets can be encrypted and decrypted within a very short time.
- Short keys: Compared to other cryptographic methods, the keys are rather short.
- One-time key exchange: The keys only have to be exchanged once, so that they can be used for secure communication countless times.
Disadvantages of symmetric encryption are
- Costly key management: Since keys must be exchanged via a secure channel, key exchange is comparatively costly.
- The key can be derived from the encryption: There is a risk that an attacker can successfully derive the key from the encryption and thus gain access to the communication.
Asymmetric encryption requires a pair of keys. One is used to encrypt and another to decrypt the files. In contrast to symmetric encryption, asymmetric algorithms are the basis here, as the name already indicates.
Advantages of asymmetric encryption are:
- The public key does not have to be kept secret. It is therefore a simple key management system
- No secure channel is required for the transmission of this key
Disadvantages of asymmetric encryption are:
- It is less permeable to data sets and is slower than the symmetric method
- The private key as a counterpart can be calculated from the public key if necessary.
Another possibility for the encryption of data is hybrid encryption. This variant is intended to compensate for the disadvantages of asymmetric and symmetric encryption and attempts to combine the advantages. The simple key system of asymmetric encryption is combined with the speed of symmetric encryption.
Depending on the model, the data storage devices in local networks can encrypt the data stored on them. The user must have the data decrypted each time the device is restarted. The procedure varies from manufacturer to manufacturer. Sometimes a USB stick with the key must be inserted for decryption, while others only require a password to be entered.
At first glance, encryption appears to be quite complex. But it has a big advantage!
In the event of the loss of a data carrier on which personal data is stored, there is an immediate obligation to notify the persons concerned in accordance with Article 34 para. 1 of the GDPR. However, if the mobile data medium was encrypted according to the latest state of the art, i.e. if technical organisational measures (TOMS) were taken in advance according to Art. 34 para. 3 lit. a) and b) GDPR, a loss does not have to be reported as a rule! Furthermore, according to Article 83 para. 2 lit. c) of the GDPR, encryption must be taken into account by the supervisory authorities when deciding whether and to what extent a sanction is to be imposed.