Security Dimensions 4 and 5 per X.805 Clauses 6.4 and 6.5 are closely related: (1) Data Confidentiality (Dim 4) protects data from unauthorized disclosure - so that anyone without authorization is unable to make sense of the content. Encryption + Access Control + File Permissions + Communication Path Protection all contribute. (2) Communication Security (Dim 5) makes sure information travels solely between endpoints that are authorized, without being rerouted or intercepted on the way - protects the information path itself + including against masquerade of endpoints. The two Dimensions together cover all aspects of information secrecy from data-at-rest through communication-in-transit. (1) Encryption Categories: (a) Symmetric Encryption (block + stream) - AES-128/192/256 + ChaCha20 + 3DES (legacy + deprecated for new); (b) Asymmetric Encryption (RSA-2048/3072/4096 + ECDH + ECIES + X25519); (c) Hybrid Encryption (TLS + IPSec combine asymmetric for key exchange + symmetric for data); (d) Homomorphic Encryption (FHE + PHE - emerging for cloud computation on encrypted data); (e) Format-Preserving Encryption (FPE - retains format for PCI cardholder data); (f) Searchable Symmetric Encryption (SSE); (g) Post-Quantum Cryptography (PQC) - CRYSTALS-Kyber + Falcon + Dilithium + SPHINCS+ + Classic McEliece + BIKE + HQC + FrodoKEM per NIST PQC standardisation. (2) Encryption At-Rest: (a) Full Disk Encryption (FDE) - BitLocker + LUKS + Apple FileVault + AWS EBS + Azure Disk; (b) Database TDE Transparent Data Encryption (Oracle + MS SQL + MySQL + PostgreSQL); (c) Application-Level encryption + envelope encryption + field-level encryption; (d) Cloud KMS (AWS KMS + Azure Key Vault + Google Cloud KMS + HashiCorp Vault); (e) Customer-Managed Keys (CMK/CMEK) + Bring-Your-Own-Key (BYOK) + Hold-Your-Own-Key (HYOK); (f) Tokenization + Pseudonymization. (3) Encryption In-Transit: (a) TLS 1.3 + 1.2 (deprecated TLS 1.0/1.1 + SSL all versions); (b) IPSec ESP/AH + IKEv2; (c) SSH + SFTP; (d) VPN (IPSec + WireGuard + OpenVPN + SSL VPN); (e) MACsec IEEE 802.1AE Layer 2 link encryption; (f) WPA3 + WPA2-Enterprise wireless; (g) DTLS for UDP + QUIC TLS 1.3; (h) SRTP for voice/video. (4) Encryption In-Use: (a) Trusted Execution Environments (TEE) - Intel SGX + AMD SEV + ARM TrustZone + Apple Secure Enclave + Microsoft Pluton; (b) Confidential Computing per CCF Confidential Computing Consortium; (c) FHE Fully Homomorphic Encryption (Microsoft SEAL + IBM HElib + Google FHE); (d) Secure Multi-Party Computation (MPC). (5) Communication Security Mechanisms: (a) End-to-End Encryption (E2EE) - Signal Protocol + Double Ratchet + MLS RFC 9420; (b) Onion Routing + Tor; (c) Mix Networks; (d) Steered Communications + traffic flow analysis prevention; (e) Tunnelling (GRE + VXLAN + L2TP + L2F); (f) Lawful Interception capabilities + LEMF Law Enforcement Monitoring Facility + ETSI TS 103 280 + 3GPP TS 33.108. (6) Key Management: (a) Key generation + storage + rotation + distribution + destruction lifecycle; (b) HSM Hardware Security Modules - FIPS 140-3 Level 3/4; (c) Cloud KMS; (d) PKI Certificate Authorities; (e) Key Escrow + Key Recovery; (f) Quantum Key Distribution (QKD) emerging. (7) Confidentiality + Communication Security per X.805 Layers: (a) Infrastructure - link encryption + MACsec + IPSec + wireline + wireless; (b) Services - service-layer encryption + IMS encryption + Diameter TLS + Gx/S5/Gy interfaces; (c) Applications - application-layer encryption + email PGP/S/MIME + web TLS + DB encryption. (8) Confidentiality + Communication Security per X.805 Planes: (a) Management - encrypted management traffic SNMPv3 + NETCONF over SSH + RESTCONF over HTTPS + signed config; (b) Control - encrypted signalling Diameter TLS + SIP TLS + GTP-U IPSec; (c) End-User - subscriber traffic encryption + WebRTC SRTP + WhatsApp/Signal E2EE. (9) Threats Mitigated per X.805 Table 1: (a) Confidentiality - Removal (Y) + Disclosure (Y); (b) Communication Security - Removal (Y) + Disclosure (Y). (10) Standards: (a) ISO/IEC 27001 A.10 / A.8 (2022) Cryptography; (b) ISO/IEC 18033 Encryption algorithms; (c) ISO/IEC 19772 Authenticated encryption; (d) NIST SP 800-57 Key Management + SP 800-175A/B Cryptography Guidance + SP 800-38 Block Cipher Modes + SP 800-67 3DES Deprecation + SP 800-71 Quantum-Resistant Crypto + SP 800-208 Stateful Hash-Based Signatures + FIPS 140-3 + FIPS 186 + FIPS 197 AES + FIPS 198 HMAC + FIPS 202 SHA-3 + FIPS 203 ML-KEM + FIPS 204 ML-DSA + FIPS 205 SLH-DSA; (e) ETSI TS 119 312 Cryptographic Suites; (f) IETF RFCs 8446 TLS 1.3 + 4301 IPSec + 4253 SSH + 4880 OpenPGP + 5246 TLS 1.2 + 9420 MLS; (g) 3GPP TS 33.401/33.501 LTE/5G Encryption; (h) PCI DSS Req 3 + 4 + PA-DSS; (i) HIPAA Security Rule Encryption. (11) PQC Migration Roadmap: (a) NIST PQC Standardisation (final draft Aug 2023 + standards 2024); (b) Crypto-Agility - ability to swap algorithms; (c) Hybrid TLS 1.3 + Kyber for key exchange; (d) Hybrid Signature for non-repudiation; (e) Migration deadline - many organisations targeting 2030-2035; (f) Inventory of cryptographic dependencies (PQC readiness assessments); (g) Q-Day uncertainty + Harvest Now Decrypt Later threat. Coordinates with X.805 Layer 1/2/3 + Plane 1/2/3 + Threats Removal/Disclosure + Security Dimension 1 Access Control + Security Dimension 8 Privacy + ITU-T X.814 Confidentiality Framework + X.815 Integrity Framework + ITU-T Y.3517 + ISO/IEC 27001 + 27002 + 27017 + 27018 + 27033 + 27040 + NIST SP 800-57 + 800-175 + 800-38 + 800-208 + FIPS 140-3 + 186 + 197 + 202 + 203 + 204 + 205 + IETF TLS 1.3 + IPSec + SSH + MLS + 3GPP 5G AKA + PCI DSS + HIPAA + eIDAS + CCC Confidential Computing Consortium. ITU-T X.805 Security Dimensions 4 + 5 Data Confidentiality + Communication Security apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.