Maarg Manthan · Topic 14.17

Encryption and Cybersecurity (Cyber Swachhta Kendra)

Science & Technology › IT, Telecommunications and Computers · Topic 14.17

Encryption is the process of turning readable data, called plaintext, into unreadable ciphertext using a mathematical method and a key, so that only a person with the right key can read it. Symmetric encryption uses the same key to lock and unlock the data and is fast, as in the Advanced Encryption Standard. Asymmetric or public key encryption uses a pair of keys, a public key to encrypt and a private key to decrypt, as in RSA, and is the basis of digital signatures and secure web connections through TLS. Hashing creates a fixed fingerprint of data. Cybersecurity is the protection of systems and data from attack. In India the Cyber Swachhta Kendra, the Botnet Cleaning and Malware Analysis Centre launched in February 2017 under CERT-In, helps users to clean infected devices.

5 min read · UPSC Prelims · Science & Technology · IT, Telecommunications and Computers

At a Glance

Symmetric One shared key, AES
Asymmetric Public and private keys, RSA
Hash One-way fingerprint
Indian centre Cyber Swachhta Kendra, 2017
Nodal agency CERT-In
Exam link UPSC Prelims, Science & Technology: IT, Telecommunications and Computers

Where Does It Fit?

This topic follows the account of biometrics. After identification, the macro covers how data is protected and the Indian centre that helps users to remove malware. Previous topic: Biometrics and Virtual Reality. Next topic: National Cyber Coordination Centre.

What Are the Main Encryption Methods?

Method	Features
Symmetric encryption	The same secret key encrypts and decrypts. Fast, suited to large data. Examples: AES. The challenge is sharing the key safely
Asymmetric encryption	A public key encrypts, and only the matching private key decrypts. Slower. Example: RSA and elliptic curve cryptography
Hash function	A one-way function that produces a fixed fingerprint of data, such as SHA-256. Used to check integrity and store passwords
Digital signature	A hash of a document encrypted with the sender’s private key, which proves identity and that the document was not changed
TLS and HTTPS	Transport Layer Security uses public key methods to set up a secure session, then symmetric keys for the data
End-to-end encryption	Only the sender and receiver hold the keys, so even the service provider cannot read messages
Key management	Generating, storing and replacing keys safely is as important as the algorithm

What Is the Indian Cyber Security Framework?

CERT-In: Indian Computer Emergency Response Team, national agency for incident response, under MeitY
Cyber Swachhta Kendra: launched in February 2017, it detects botnet infections in India, notifies users and offers free tools to clean devices, with a website and a mobile app
NCIIPC: National Critical Information Infrastructure Protection Centre, set up in 2014 under the National Technical Research Organisation to protect critical sectors such as power, banking and telecom
National Cyber Security Policy, 2013: framework for secure cyber space, with a national cyber security strategy under preparation
Indian Cyber Crime Coordination Centre: I4C, set up by the Ministry of Home Affairs in 2018
Cyber Surakshit Bharat: a programme of 2018 to train chief information security officers in government
CERT-In directions, 2022: require reporting of incidents within six hours and keeping of logs
Defence Cyber Agency: tri-service agency created in 2019

What Else Should You Remember?

Plaintext and ciphertext: readable data and its scrambled form
Key length: longer keys are harder to break, for example 256-bit AES
Caesar cipher: an ancient shift cipher, a simple example of substitution
Man-in-the-middle: an attack where a person secretly sits between two parties, which TLS helps to stop
Traceability dispute: the IT Rules, 2021 require some messaging services to identify the first originator of a message, which platforms say conflicts with end-to-end encryption
Section 69 of the IT Act: lets the Government direct decryption of information for security, as in Cyber Law in India
Botnet: a network of infected devices controlled by an attacker, used for spam and attacks
Post-quantum: quantum computers could break RSA, so new algorithms are being adopted, as in Quantum Computing
Digital signature certificates: issued by licensed certifying authorities and used for tax filing and tenders
Aadhaar eSign: a service that signs documents electronically using Aadhaar authentication
Cybersecurity awareness: Cyber Jaagrookta Diwas and campaigns by the Government educate users
Link: tools such as firewalls are in Computer Security Tools: Firewalls, Hackers, VPN
Passwords and hashing: good systems store only salted hashes of passwords, so that leaks do not reveal the actual passwords
Certificates and certifying authorities: a digital certificate ties a public key to an identity, issued by a trusted authority licensed under the IT Act
Wi-Fi security: WPA3 is the latest standard for protecting wireless networks, replacing older WEP and WPA
Encryption at rest and in transit: data should be encrypted when stored on devices and when sent over networks
Cybersecurity budget: security spending is a small share of IT budgets in many organisations, a gap that attackers exploit

Why Does It Matter for the Exam?

Types: symmetric versus asymmetric
Terms: hash, digital signature, TLS
Indian bodies: CERT-In, NCIIPC, I4C, Cyber Swachhta Kendra
Current affairs link: encryption and traceability debate
Common errors: saying that a public key decrypts or that hashing is reversible

As an analytical point, strong encryption protects privacy and commerce, but governments want access for security. Balancing the two, and preparing for quantum threats, are central policy challenges.

Why Is This Topic Important?

Methods Symmetric and public key
Agencies CERT-In and NCIIPC
Debate Traceability

What Came Next?

The next topic covers the National Cyber Coordination Centre. Next topic: National Cyber Coordination Centre.

Key People and Terms

Ciphertext Encrypted data
Key Secret value for encryption
Hash One-way fingerprint
TLS Transport Layer Security
E2EE End-to-end encryption
NCIIPC Critical infrastructure protection centre

Exam Corner

Points to Remember

AES is symmetric; RSA is asymmetric.
Cyber Swachhta Kendra: February 2017.
NCIIPC: 2014; I4C: 2018.
CERT-In incident reporting: six hours.
Hashing is one-way.

Do Not Confuse With

Encryption and hashing Reversible with a key versus one-way
CERT-In and NCIIPC General incidents versus critical infrastructure
Public key and private key Encrypts or verifies versus decrypts or signs

Memory Hook

Same key is symmetric, key pair is public; hash cannot be undone, signature proves the sender.

Mains Angle

Questions ask for types of encryption and Indian bodies. These points help.

Methods Keys and hashes
Institutions Indian agencies
Dilemma Privacy versus security

A Question You May Face

An original practice question, not a past paper question.

“Explain the principles of encryption and discuss the institutional framework for cyber security in India.”

How to Answer

Methods Symmetric, asymmetric.
Uses TLS, signatures.
Bodies CERT-In, NCIIPC.
Debate Traceability.

GS Relevance

Prelims: types of encryption, hashing, digital signature, Cyber Swachhta Kendra, CERT-In. GS Paper 3: cyber security, internal security.

Frequently Asked Questions

What is encryption?

Encryption is the process of converting readable data into an unreadable coded form using an algorithm and a secret key, so that only authorised people with the correct key can read it. It protects data stored on devices and sent over networks, in applications such as online banking, messaging and secure websites.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared secret key for both encryption and decryption, and is fast but needs a safe way to share the key. Asymmetric encryption uses a pair of keys, a public key to encrypt and a private key to decrypt, which solves the key sharing problem but is slower. Real systems combine both.

What is a digital signature?

A digital signature is an electronic way of proving who sent a document and that it has not been changed. The sender creates a hash of the document and encrypts it with a private key. The receiver decrypts it with the public key and compares hashes. In India, digital signatures are recognised under the Information Technology Act, 2000.

What is the Cyber Swachhta Kendra?

The Cyber Swachhta Kendra, or Botnet Cleaning and Malware Analysis Centre, was launched in February 2017 under CERT-In and the Ministry of Electronics and Information Technology. It detects botnet infections in India, informs users through internet service providers and gives free tools to remove malware, as part of Digital India's goal of a clean cyber space.

What is the role of NCIIPC?

The National Critical Information Infrastructure Protection Centre, set up in 2014 under the National Technical Research Organisation, is the nodal agency for protecting critical information infrastructure in India, such as systems of power, banking, telecom, transport and government. It issues guidelines, shares threat information and works with operators of critical systems.

PYQ Practice — Statement Analysis

1 RSA is an example of asymmetric encryption.

True

Using a public and private key pair.

2 A hash function can be reversed to recover the original data.

False

Hashing is one-way.

3 The Cyber Swachhta Kendra was launched in 2017.