What is the difference between Encryption and Compression? What order should they be done in?

The Digital Age we live in requires more and more data to be sent at one time, but this can quickly become an issue for the hardware sending the data. If too much data is sent across a connection, it could take hours or days to transfer, when the recipient needs it in minutes. This is where compression comes in. Compression uses patterns in data to shorten the size of the data, saving bandwidth and storage space in the process. This works well, but what if the compressed data is stolen in transit? Compression is not complicated to reverse so retrieving the original would be easy. This is why many people use encryption and compression together when sending messages.

What is Compression and how it works

Compression is a process that reduces the size of a file or data, typically to save storage space, speed up data transmission, or improve efficiency in various applications. There are two main types of compression: lossless and lossy. In compression algorithm any phrase that is repeated gets stored once. This means that if a certain string of characters is repeated somewhere in the text, it is only stored the first time. The second time it occurs as a reference to the first occurrence, therefore when a text occurs multiple times it is very efficiently compressed so the size is smaller. This characteristic can be used in a compression side channel attack. Here’s how it works:

• Redundancy Removal

  Compression algorithms identify and eliminate redundancy in the data. Redundancy can occur in the form of repeated patterns, duplicate information, or unnecessary details. By removing redundancy, the compressed data representation becomes more efficient.

• Dictionary-based Compression

  Some compression algorithms, such as Lempel-Ziv-Welch (LZW), use a dictionary-based approach. They build a dictionary of frequently occurring patterns and replace them with shorter codes. This is particularly effective for compressing text or data with recurring sequences.

• Entropy Coding

  Entropy coding techniques, like Huffman coding, assign shorter codes to more frequently occurring symbols and longer codes to less frequent ones. This exploits the statistical distribution of symbols in the data to achieve .

• Quantization (Lossy Compression)

  In lossy compression, quantization is applied to reduce the precision of certain data, sacrificing some details. For example, in image compression, color values may be rounded, leading to a loss of color accuracy but a reduction in file size.

• Transform Coding (e.g., Discrete Cosine Transform)

  Transform coding involves converting the data into a different domain where the information is more concentrated. In image and video compression, the Discrete Cosine Transform (DCT) is commonly used for this purpose.

Encryption and Compression

Encryption can be either symmetric or asymmetric. Symmetric encryption is the less complicated of the two, using one key to encrypt and decrypt data. Symmetric encryption is much faster than asymmetric encryption, but is not as secure. Only one key needs to be compromised to compromise the original data. Asymmetric encryption uses a public and private key pair to encrypt plaintext data. The plaintext is run through the encryption algorithm along with a private key, which only the sender knows. The data is then sent to the recipient, who uses the public key to decrypt the data. This ensures the identity of the sender of the data, as the public key only decrypts data encrypted with the private key in that pair.

Using encryption and compression, larger portions of data can be sent across the Internet securely. If only compression is used, the security of the data is at risk. A Man in the Middle attack could retrieve the data, decompress it, and read the original message. On the other hand, if only encryption were used, there is a limit to how big a message that is encrypted can be. This is why the majority of messages are both encrypted and compressed. The next question to answer is do you compress the data and then encrypt the data, or vice versa?

Encryption or Compression first?

The choice of encrypting or compressing data first depends on the types of attacks you need to circumnavigate. Initially, it was thought that the only way to combine encryption and compression was to compress the data before encryption. This is due to the fact that compression relies on patterns in data to function, while encryption attempts to destroy these patterns in data. The method of compression then encryption has been found to be weak to side channel attacks. These types of attacks use JavaScript code to perform a brute force attack on the victim’s browser, allowing the attacker to infer what the transmitted data is based on the size of that compressed data.

Though this issue was found with the method of compression then encryption, encryption then compression has many more issues comparatively. This method is more difficult than the previous method, because compression needs patterns in data to work correctly. This means the value of compressing data will not exist, as there should be no patterns in encrypted data. Due to this, differential cryptanalysis can be used against this method to determine the sensitive data’s value. Compression then encryption is much more resilient to differential cryptanalysis.

Common Encryption and Compression Algorithms

Symmetric Encryption Algorithms:

• Advanced Encryption Standard (AES)
• Blowfish 
• Twofish 
• Rivest Cipher (RC4)
• Data Encryption Standard (DES)

Asymmetric Encryption Algorithms:

• Elliptic Curve Digital Signature Algorithm (ECDSA)
• Rivest-Shamir-Adleman (RSA) 
• Diffie-Hellman
• Pretty Good Privacy (PGP)

Hashing Algorithms:

• Deflate
• Huffman Coding
• LZ77