kubernetes kubernetes/networking encryption
Core Idea
Encryption comes in three placements: at rest protects stored data, in transit protects data on the wire, and end-to-end protects it between the real endpoints.
- Encryption at rest: unreadable disks and databases even if access is gained.
- Encryption in transit: protected data as it crosses networks.
- Encryption end-to-end: only the endpoints can read it.
Encryption Types: At Rest, In Transit, and End-to-End
- Encryption at Rest
- Protects data stored on disks, databases, or other storage systems.
- Ensures data is unreadable to unauthorized users if physical or logical access is gained.
- Common methods: Disk encryption, database encryption, and file-level encryption.
- Example: Encrypting files on cloud storage using AES-256.
- Encryption in Transit
- Secures data being transmitted between systems or devices.
- Prevents interception or tampering during transmission.
- Common protocols: HTTPS (TLS), VPNs, and secure email protocols.
- Example: Using HTTPS to protect data sent from a browser to a server.
- End-to-End Encryption (E2EE)
- Data is encrypted on the sender’s device and decrypted only on the receiver’s device.
- Prevents intermediaries (e.g., ISPs, servers) from accessing the content.
- Often used in messaging apps and secure communication tools.
- Example: WhatsApp or Signal messages encrypted using public-key cryptography.