Symmetric and asymmetric encryption

Why encryption

Data travels over networks you do not control and sits on disks that can be stolen. Encryption turns readable data (plaintext) into scrambled data (ciphertext) using a key. Without the key, the ciphertext is useless. This protects confidentiality, both in transit (moving over a network) and at rest (stored on a disk).

An old idea: the Caesar cipher

The Caesar cipher shifts every letter by a fixed number. With a shift of 3, A becomes D and B becomes E. The key is the number 3. It is easy to understand and trivially easy to break: there are only 25 possible shifts, so an attacker tries them all. It is useful only to learn the words key, plaintext and ciphertext.

def caesar(text, shift):
    out = ""
    for ch in text:
        if ch.isupper():
            out += chr((ord(ch) - 65 + shift) % 26 + 65)
        elif ch.islower():
            out += chr((ord(ch) - 97 + shift) % 26 + 97)
        else:
            out += ch
    return out

secret = caesar("Meet at Gate 4", 3)
print(secret)
print(caesar(secret, -3))

Symmetric encryption: one shared key

In symmetric encryption, the same key locks and unlocks. Modern symmetric ciphers like AES (Advanced Encryption Standard) with 128- or 256-bit keys are very fast and, used correctly, unbreakable in practice. AES protects BitLocker disks, Wi-Fi (WPA2/WPA3), VPN tunnels and the data part of every HTTPS connection.

A simple building block inside many ciphers is XOR (exclusive or). XOR-ing data with a key scrambles it; XOR-ing again with the same key gives the data back. On its own, a short repeating XOR key is weak and easy to break, but it shows the "same key both ways" idea.

The big problem with symmetric encryption is key sharing: how do two people who have never met agree on a secret key over an open network, without anyone listening learning it?

Asymmetric encryption: a key pair

Asymmetric (public-key) cryptography uses two keys that belong together. The public key can be shared with anyone. The private key is kept secret. What one key locks, only the other can unlock. Common algorithms are RSA and elliptic-curve cryptography (ECC), such as ECDSA and Ed25519.

• Encrypting to someone: use their public key; only their private key decrypts.
• Digital signature: the sender signs with their own private key; anyone can verify with the sender's public key. This proves who sent it (authenticity) and that it was not changed (integrity), and the sender cannot deny it (non-repudiation).
• Key exchange: methods like Diffie-Hellman (and its elliptic-curve form, ECDHE) let two sides agree on a shared secret over an open network.

Hybrid encryption: using both

Asymmetric cryptography is slow, so real systems combine both. In HTTPS, asymmetric cryptography proves the server's identity (certificate and signature) and agrees on a fresh symmetric key (ECDHE). Then fast AES or ChaCha20 encrypts the actual data. Signal, WhatsApp, VPNs and SSH work in a similar way.

Common mistakes

• Inventing your own encryption. Always use well-known, tested libraries and algorithms.
• Hard-coding keys in source code or pushing them to GitHub. Use a secrets manager.
• Sharing a private key, or emailing it. A private key should never leave its owner.
• Confusing encoding with encryption. Base64 only changes the format; anyone can decode it.