Importance and Types of Encryption in Cyber Security

Every time you enter your card number on a shopping site or scan a QR code to pay, your data travels through networks that thousands of strangers could technically intercept. It reaches its destination safely because of one quiet mechanism working in the background: encryption. In e-commerce, where money, personal details, and business records move online every second, encryption is not a technical afterthought. It is the legal and practical foundation on which digital trust is built, and the IT Act 2000 was the first Indian law to give it formal recognition.

What encryption actually does 🔗

Encryption is the process of converting readable information, called plain text, into a scrambled, unreadable format called cipher text. Decryption reverses this process, turning the cipher text back into its original form using a key. Without the correct key, the cipher text looks like meaningless noise to anyone who intercepts it.

The Information Technology Act, 2000 was India’s first attempt to give legal structure to this idea. It was drafted to support electronic commerce and electronic governance, and encryption sits at the centre of that goal because digital transactions cannot be trusted unless the data behind them is protected from tampering and unauthorised access.

How the IT Act 2000 addresses encryption 🔗

The Act does not prescribe a single fixed encryption standard. Instead, it builds a framework that allows encryption practices to evolve alongside technology, while keeping the government in a position to regulate and, when necessary, access encrypted data.

Section 84A: Power to prescribe modes of encryption 🔗

Inserted through the 2008 amendment, Section 84A empowers the central government to prescribe modes or methods of encryption for the secure use of electronic mediums and for promoting e-governance and e-commerce. This is a deliberately flexible provision. Rather than locking the law to one algorithm, it lets regulators update encryption standards as cryptography advances.

Section 69: Power to intercept and decrypt 🔗

Balancing this is the government’s power to direct any agency to intercept, monitor, or decrypt information stored in a computer resource, when it is necessary in the interest of national security, public order, or the investigation of an offence. This provision recognises that strong encryption, while essential for privacy and commerce, can also be misused, and it gives law enforcement a legal route to access data under defined circumstances.

Sections 3, 3A, and 5: Digital signatures built on encryption 🔗

The Act gives legal recognition to electronic records authenticated through digital signatures, and specifically ties this recognition to asymmetric cryptography. Under this system, a digital signature is created by encrypting a hash of the document using the signer’s private key, and any change to the document after signing produces a completely different hash value, which causes the signature verification to fail. This is what makes electronic contracts, e-invoices, and online agreements legally reliable. The 2008 amendment added Section 3A to recognise broader forms of electronic signatures as technology diversified beyond the original digital signature model.

The two types of encryption the law works with 🔗

Encryption used in Indian e-commerce and recognised in the broader legal and technical framework falls into two categories: symmetric and asymmetric. Each solves a different part of the security problem.

Symmetric encryption 🔗

Symmetric encryption uses a single secret key to both encrypt and decrypt data. The sender and receiver must both possess this same key beforehand. Its biggest advantage is speed. Because the underlying mathematics is simpler, symmetric encryption is generally faster and requires less processing power than asymmetric encryption, which makes it well suited to encrypting large volumes of data, such as database records or files.

The catch is key distribution. Both parties need a secure way to exchange the shared key before communication starts. If that key is intercepted during transfer, the entire system is compromised, since anyone holding it can decrypt every message protected by it.

Asymmetric encryption 🔗

Asymmetric encryption solves the key-sharing problem by using a mathematically linked pair of keys: a public key that can be shared openly, and a private key that is kept secret by its owner. Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. This is the model the IT Act explicitly recognises for digital signatures, since a message encrypted using the sender’s private key can be decrypted by anyone holding the corresponding public key, which proves the message genuinely came from that sender.

Asymmetric encryption is slower than symmetric encryption because of its longer keys and heavier computation, but it removes the need to exchange a secret key over a potentially unsafe channel. This is why it is the preferred method for establishing trust between two parties who have never communicated before, such as your browser and an online store’s payment gateway.

Why this matters for digital transactions 🔗

E-commerce depends on four things happening correctly every time you shop, pay a bill, or sign a contract online: confidentiality, so your card details cannot be read by outsiders; integrity, so the order amount or contract terms cannot be silently altered; authentication, so both parties know who they are really dealing with; and non-repudiation, so a signer cannot later deny having agreed to a transaction. Symmetric encryption works well for confidentiality of large data volumes, while asymmetric encryption is best suited for digital signatures, secure key exchange, and authentication, which is why most real systems use both together.

A typical secure website connection illustrates this combination well. During a website’s secure handshake, the browser uses the site’s public key to help set up a shared session key, after which the actual data exchange switches to faster symmetric encryption. Asymmetric cryptography establishes trust at the start of the connection; symmetric cryptography then does the heavy lifting of encrypting the ongoing traffic.

Where you meet this in Indian digital commerce 🔗

This dual-encryption model quietly runs underneath activities students interact with daily:

• Secure browsing: Any website using HTTPS relies on this handshake to protect login details and payment data.
• UPI and net banking: Payment apps encrypt transaction data end to end, and digital signatures authenticate the parties involved.
• Government and MCA filings: Company incorporation documents, GST returns, and court filings increasingly require Digital Signature Certificates issued by licensed Certifying Authorities, which are built entirely on asymmetric cryptography.
• E-contracts and e-invoices: Businesses rely on digital signatures to make electronic agreements legally binding without needing physical signing.

The other side: regulation and compliance 🔗

Because encryption can be misused to hide criminal activity, Indian regulators keep a close eye on how it is deployed. The Indian Computer Emergency Response Team (CERT-In), established under Section 70B of the IT Act, issues guidelines that push organisations toward stronger data protection practices, including encrypting sensitive information at rest and in transit. Businesses handling customer data for e-commerce, especially payment and personal information, are expected to align with these evolving standards, alongside sector-specific rules from bodies like the RBI for digital payments.

This creates a constant balancing act. Strong encryption protects consumers and businesses from fraud and data theft, but it can also make lawful investigation harder. Section 69’s decryption powers exist precisely to give the state a legal, narrowly defined route into encrypted data when public interest genuinely requires it, rather than weakening encryption standards for everyone.

What do you think? 🔗

What do you think? If every e-commerce platform you use already relies on both symmetric and asymmetric encryption without you noticing, does encryption law need to focus more on regulating businesses that handle your data, or on giving individuals more visibility into how their information is protected? And as quantum computing develops, should India’s encryption framework under the IT Act be revisited sooner rather than later?

References

1. https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf
2. https://bhattandjoshiassociates.com/digital-signature-laws-in-india/
3. https://www.ibm.com/think/topics/symmetric-encryption
4. https://blog.ipleaders.in/digital-electronic-signature/
5. https://www.geeksforgeeks.org/computer-networks/difference-between-symmetric-and-asymmetric-key-encryption/
6. https://www.esignglobal.com/blog/electronic-signature-valid-information-technology-act-2000-india
7. https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=1936470&reg=48&lang=2