Data & cryptography
Definiciones en lenguaje claro del tema data & cryptography.
AES (Advanced Encryption Standard)
AES is the symmetric encryption algorithm used almost everywhere to protect sensitive data, standardised by NIST in 2001 and still the default choice for confidentiality at rest and in transit.
Argon2id
Argon2id is a password hashing function, specified in RFC 9106, designed to be expensive in memory as well as in time. It is the current default recommendation for storing passwords, because making an attacker’s hardware buy memory is what removes the advantage that fast parallel cracking rigs otherwise have.
Data classification
In data security, data classification is the labelling of data by sensitivity so that policies about handling, storage and access can be applied. Classification enables policy; it does not apply it. Automatic enforcement depends on tools that act on the labels, and in most organisations the labelling itself is manual and ages over time.
Decryption
Decryption is the process of turning encrypted data back into its original readable form. It is the half of cryptography where key management decides whether any of it worked.
Degaussing
Degaussing erases magnetic media by applying a field strong enough to scramble the information it holds. It is used when retiring mechanical hard drives, tapes and magnetic stripes: done properly the data cannot be recovered, and done to a solid state drive it erases nothing at all.
Digital signature
In cryptography, a digital signature proves that a message was produced by the holder of a private key and was not altered afterwards. It is the correct, valuable use of a hash function, and it underpins code signing, DNSSEC, document signing and the schemes behind qualified electronic signatures in the EU.
DLP
In data security, DLP (data loss prevention) classifies, monitors and blocks sensitive data as it leaves an organisation. The channels have moved on: alongside email and removable media, data now leaves through SaaS, browsers, personal storage, code repositories and, above all, pasting into AI assistants. It is bought inside a wider SSE or endpoint platform.
Encryption algorithms
An encryption algorithm is the set of mathematical rules used to turn readable information into ciphertext and back again, so that only the holder of the right key can recover what it says.
Encryption at rest
Encryption at rest means storing data in encrypted form so that a stolen disk, a copied backup or a discarded drive is useless without the keys. It protects against physical and storage-layer access only: an application or an identity authorised to read the data still reads it in the clear, which is the part people misread.
Encryption in transit
In data security, encryption in transit protects data as it travels across a network, usually with TLS, so it cannot be read or altered in flight. It is one arm of the encryption story, sitting alongside encryption at rest and encryption in use, and each protects data in a different state, which is why they are not interchangeable.
Envelope encryption
Envelope encryption is the pattern behind most encryption at rest in cloud platforms: data is encrypted with a data key, and that data key is then encrypted with a key encryption key held in a key management service. The wrapped data key is stored next to the ciphertext, and the master key never leaves the service.
Hardware security module (HSM)
A hardware security module is a dedicated device that generates and stores cryptographic keys and performs operations with them, built so that the key material cannot be exported in the clear. Applications send data to be signed or decrypted and receive a result, never the key itself.
Hash function
In cryptography, a hash function turns arbitrary input into a fixed-size fingerprint that is hard to reverse. A cryptographic hash must resist preimage, second-preimage and collision attacks; it underpins integrity checks and digital signatures. Passwords are the exception: they need a purpose-built key derivation function, never a fast general-purpose hash.
HMAC
HMAC is a message authentication code built from a hash function and a shared secret key, specified in RFC 2104. It proves that a message was not altered and that it came from someone holding the key, which is a different guarantee from a digital signature: both parties can produce it, so it establishes authenticity but not non repudiation.
Key derivation function (KDF)
In cryptography, a key derivation function (KDF) turns a password or shared secret into a cryptographic key, and for password storage it is deliberately slow and memory-hard so that guessing is expensive. It is the control that actually resists cracking, and the entry that repairs the incorrect hash-function advice and the outdated salt advice, because both point here.
KMS
In cloud security, a KMS (key management service) generates, stores and rotates cryptographic keys and performs operations with them without ever handing the key material back. That non-release is its defining property: it is distinct from a secrets manager, which stores credentials your applications actually read.
PII
In data protection, PII (personally identifiable information) is the United States framing for data that identifies a person. Under the GDPR the operative concept is personal data, which is broader: it covers online identifiers, IP addresses, cookies and pseudonymised data. In Spain and the EU, personal data is the canonical term, and PII narrows the scope.
Post-quantum cryptography
In cryptography, post-quantum cryptography is the family of algorithms designed to remain secure against an attacker with a large quantum computer, which would break the public-key schemes protecting most traffic today. It is the boardroom question of the moment, and the answer depends on how long a given piece of data has to stay confidential.
Public key infrastructure (PKI)
In cryptography, a public key infrastructure (PKI) is the system of certificate authorities, certificates and revocation that binds a public key to an identity and lets parties trust that binding. It underpins TLS, mutual TLS, digital signatures and DNSSEC, so five other entries point at a concept that has to exist here.
Salt
In password storage, a salt is a unique random value stored alongside each password hash so that identical passwords do not produce identical hashes and precomputed tables are useless. A salt is not secret, and it does not slow an attacker down: that is the job of the key derivation function’s cost. Modern algorithms generate and store it for you.
Secrets management
In application and cloud security, secrets management is the storage of API keys, certificates and passwords with rotation, access control and audit, instead of in code or configuration. It is a constant finding in cloud tests, and a control worth keeping distinct from a KMS, because a secrets manager returns the secret to be read.
Secure data erasure
Secure erasure is the set of techniques that remove stored information permanently, so that it cannot be recovered by anybody who later gets hold of the device or the storage it lived on.
Steganography
In security, steganography is the practice of hiding a message inside another file or channel so that nobody notices there is a message at all. It does not replace encryption or compete with it: encryption makes the content unreadable and admits it exists, while steganography tries to stop anyone asking.