Encryption algorithms

An encryption algorithm is a set of mathematical rules and procedures used to encrypt and decrypt information, so that it stays out of reach of anyone not authorised to read it while it is being transmitted or stored.

Algorithms of this kind are what make confidentiality possible in a digital environment, and they turn up everywhere: secure communication over the internet, protected storage of sensitive records, signed software updates, encrypted backups.

What they do is transform information from a readable form into an unreadable one, the ciphertext, using a specific key. Only whoever holds the correct key can reverse the transformation and recover the original. That is what makes interception survivable: a third party who captures the ciphertext without the key has captured nothing readable.

Symmetric and asymmetric

There are two main families.

Symmetric algorithms use the same key to encrypt and to decrypt. They are fast and efficient, which is what makes them the right choice for large volumes of data: disk encryption, database encryption, the bulk of a TLS session once it is established.

Asymmetric algorithms use a key pair, one public and one private. They are slower, and their value is elsewhere: key exchange, digital signatures and authentication. They solve the problem symmetric cryptography cannot solve on its own, which is how two parties who have never met agree on a shared secret over a channel somebody may be listening to.

Almost every real system uses both. The asymmetric part establishes the session, and the symmetric part carries the traffic.

How much security a cryptographic system actually provides depends heavily on the strength of the algorithm chosen and on the size of the key, and the answer changes over time: an algorithm that was adequate fifteen years ago may be broken, deprecated or simply too small today.

A worked example

Two parties, call them Alice and Bob, want to communicate securely over the internet. They use an asymmetric algorithm such as RSA. Each of them generates a key pair, one public and one private.

Alice shares her public key with Bob, and Bob shares his with Alice. When Alice wants to send Bob a message, she encrypts it with Bob’s public key.

Only Bob, who holds the matching private key, can decrypt and read it. That is the whole idea: the keys make it possible to communicate securely across a channel nobody controls.

By algorithm or by state of the data: two ways of sorting encryption

This glossary classifies encryption in two ways that do not compete with each other, and mixing them up is what makes an audit answer look complete when it is not.

This entry classifies by algorithm: symmetric or asymmetric, which key encrypts and which key decrypts.

Encryption at rest and encryption in transit classify by where the data is when it is protected. What they answer is not which mathematics is used but which adversary each one protects against: the stolen disk and the copied backup in one case, interception on the network in the other. Neither of them protects against a stolen credential, which is how most breaches actually happen.

Post-quantum cryptography is a third axis, the one about time: which algorithms stop being usable once a large enough quantum computer exists. It affects the asymmetric ones, which are what hold up key exchange and signatures, and affects the symmetric ones very little.

The three axes are independent. A system can use RSA, have nothing encrypted at rest, and still be exposed to somebody recording its traffic today in order to decrypt it in ten years.

And there is a question the algorithm does not answer: who guarantees that a public key belongs to whoever claims it. That is what public key infrastructure is for.

Where to read more

NIST, Cryptographic Toolkit: the National Institute of Standards and Technology publishes the standards and reference material for the algorithms in current use, including which ones are approved and which have been withdrawn.

Crypto101: a free introduction to cryptography, useful for understanding both the theory and how it is applied.

Khan Academy, Cryptography: interactive lessons covering the basics, including an introduction to encryption algorithms.