Encryption

In November 2024, the Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) jointly announced that the People’s Republic of China (PRC) had compromised the infrastructure of multiple telecommunications companies.¹ Both Microsoft Corporation and the United States Government use names ending in Typhoon to refer to attacks carried out with PRC state sponsorship. The particular group of hackers in this case, whose exact identities are not necessarily known to the intelligence community, has been labeled Salt Typhoon using this nomenclature.² Unfortunately, both the breadth and depth of these attacks might not be known for some time, since Donald Trump fired the expert review board that was investigating the attack shortly after he took office.³

CISA recommended that “highly targeted individuals” encrypt their communications and improve their overall security in December 2024.⁴ Although CISA is trying to walk a fine line by focusing on “highly targeted individuals,” using encryption is a best practice for both security and privacy. Many of the vulnerabilities that enabled the Salt Typhoon hack were a direct result of the federal government discouraging proper end-to-end encryption by average Americans. Law enforcement agencies, including the FBI, have historically campaigned for backdoor access into all encrypted communications systems used by regular people. The familiar two reasons – catching terrorists and detecting child exploitation – have been cited in the demand for “lawful access.” ⁵ However, at the mathematical level, data are either securely encrypted or they are not. There is no “middle ground” where only the “good guys” get access to the unencrypted data. Thanks directly to these law enforcement efforts to prevent or weaken proper end-to-end encryption, the Chinese Communist Party now has direct access to Americans’ personal communications.⁶

In this section, we’re going to learn what encryption is, why it is important, why we should all be using it (even if parts of our government don’t want us to do so), and how we can use encryption principles to safeguard our passwords.

Contents

• Encryption Basics
• Types of Encryption
• Cryptanalysis
• Forced Decryption
• Steganography
• Encrypted Communications
• Passwords
• Password Management

Notes and References