Cryptography

Cryptography comprises the mathematical methods used to transform information so that only authorised parties can read it or verify its authenticity. It serves the classic protection goals of information security: confidentiality (secrecy), integrity (freedom from tampering), authenticity (proof of origin) and non-repudiation. Three fundamental building blocks are distinguished: symmetric encryption, asymmetric encryption and cryptographic hash functions.

In symmetric encryption, sender and recipient use the same secret key to encrypt and decrypt; established methods such as AES (Advanced Encryption Standard) are highly performant and well suited to large volumes of data, but require a secure channel for exchanging the key. Asymmetric methods (public-key cryptography) such as RSA or elliptic curves (ECC) use a key pair consisting of a public and a private key; they solve the key-exchange problem and enable digital signatures, but are more computationally intensive. In practice both are combined (hybrid encryption), for example in TLS, where a symmetric session key is negotiated asymmetrically.

Cryptographic hash functions such as SHA-256 produce a fixed, irreversible checksum from arbitrary input, thereby protecting the integrity of data, serving as the basis for digital signatures and enabling the secure storage of passwords (with a salt and methods such as bcrypt or Argon2). For regulated organisations, cryptography is a central technical and organisational safeguard: it is explicitly required as a risk-treatment measure under the NIS2 Directive and the German IT Security Act, and is at the same time a recognised technical and organisational measure for protecting personal data under the GDPR. What matters is the use of current algorithms and key lengths regarded as secure, in line with the technical guidelines of the German Federal Office for Information Security (BSI).