Cryptographic Use Cases and Techniques

What it is

A use case is a business need, such as protecting email or keeping an audit trail unalterable. A technique is the method chosen to meet it. This page covers six choices that are easy to confuse.

How it works

Secure email with S/MIME and PGP

Secure/Multipurpose Internet Mail Extensions (S/MIME) and Pretty Good Privacy (PGP, standardized as OpenPGP) protect messages end to end. Both can sign a message, encrypt it, or do both.

S/MIME relies on X.509 certificates issued by a certificate authority, and the sender needs the recipient's certificate before encrypting. PGP uses keys that users exchange and vouch for, called a web of trust, instead of a central authority.

A signature does not hide the content, and encryption alone does not prove who sent the message. Subject lines and addresses usually stay visible, and end to end encryption blinds gateways that scan mail for malware.

Immutable databases and blockchain

An append-only ledger never edits old records, it only adds new ones. Hash chaining links them: each record stores the hash of the one before it, so changing an old record changes its hash and breaks every later link. The result is tamper evident history.

A blockchain adds copies held by many nodes, which use a consensus method to agree on the next block. Typical uses are audit trails and provenance.

Immutable means tamper evident, not tamper proof, since an attacker who controls enough of the consensus could rewrite history. Bad data stays forever, and permanent records can clash with a right to erasure.

Data anonymization

Anonymization removes the link between data and a person so identification is no longer reasonably possible. Pseudonymization swaps identifiers for pseudonyms that a separate key or table can reverse, so privacy laws still treat the data as personal.

Common methods follow.

• Generalization: replace exact values with ranges, such as an age band instead of a birth date.
• Suppression: remove fields or rare records.
• Aggregation: publish totals, not rows.

K-anonymity is a test: each record must look identical to at least k minus 1 others on the quasi-identifiers, such as birth date, postal code and gender. Re-identification risk remains when a dataset can be linked to another one.

Serialization

Serialization turns an object into bytes or text so it can be stored or sent, for example as JSON or XML, and deserialization rebuilds it. The same data must give the same bytes each time, or signatures will not verify.

Protect the serialized form. Sign it with a keyed hash or digital signature to detect changes, encrypt it if it is confidential, and verify the signature before deserializing.

The main risk is insecure deserialization, where untrusted input rebuilds objects that run attacker chosen code. Prefer plain data formats, validate against a schema, and never deserialize untrusted data with a native object format.

One-time pad

A one-time pad combines the message with a key using exclusive OR (XOR). It gives perfect secrecy, but only if the key is truly random, is as long as the message, is kept secret, and is never reused.

Reuse is fatal, because combining two ciphertexts reveals the relationship between the plaintexts. The pad is impractical: the key is as big as the data, must be exchanged securely in advance, and needs true random generation. It also gives no integrity.

Lightweight cryptography

Lightweight cryptography suits constrained devices such as sensors, smart cards and radio tags, which have little processing power, memory and battery. The algorithms use small code and low energy while still giving strong protection.

The National Institute of Standards and Technology (NIST) selected the Ascon family for its lightweight standard, providing authenticated encryption and hashing. Use vetted standards and unique per device keys, not a custom cipher.