What is data encryption?

What is data encryption?

Encryption keeps data confidential: even if someone steals it or intercepts it, they see only meaningless scrambled data. It doesn't stop data being taken; it makes the stolen copy useless without the key. These are the terms the AQA A-level specification expects you to know:

Modern ciphers are public: anyone can read exactly how they work. Their security comes entirely from keeping the key secret. That way, experts around the world can test a cipher for weaknesses before everyone relies on it.

How does encryption work? Two classic examples

The Caesar cipher

The Caesar cipher shifts every letter a fixed number of places along the alphabet. The shift is the key. With a key of 3, A becomes D, B becomes E, and so on, wrapping round so that X becomes A:

Plaintext:   MEET AT NOON
Key:         shift 3
Ciphertext:  PHHW DW QRRQ

To decrypt, shift each letter back 3. The Caesar cipher is easily cracked, though: there are only 25 useful keys, so you can simply try them all, which is called a brute force attack. Letter patterns give it away too: the double letters EE and OO stay double, and in English text the most common letter is usually E, so the most common ciphertext letter is probably E shifted.

The Vernam cipher (one-time pad)

The Vernam cipher combines each bit of the message with a bit of a random key using XOR (exclusive or): the result is 1 when the two bits differ and 0 when they match. Here is the letter H, stored as the binary code 01001000:

Plaintext H:   0 1 0 0 1 0 0 0
Key:           1 0 1 1 0 1 1 0
XOR:           1 1 1 1 1 1 1 0   <- ciphertext

Ciphertext:    1 1 1 1 1 1 1 0
Same key:      1 0 1 1 0 1 1 0
XOR:           0 1 0 0 1 0 0 0   <- H again

XORing with the same key twice gets you back where you started, so one operation both encrypts and decrypts. AQA notes that the Vernam cipher is the only cipher mathematically proved to be completely secure, as long as the key is truly random, at least as long as the message, kept secret and used only once (hence "one-time pad"). The catch is sharing a key that long, securely, for every message. You can check the binary codes with our Number Base Converter.

Symmetric encryption

In symmetric encryption, the same key encrypts and decrypts, like the Caesar and Vernam ciphers. The standard modern one is AES (Advanced Encryption Standard), chosen by the US standards body NIST in 2000 and published as FIPS 197 in 2001. It scrambles data in blocks of 128 bits, with a key of 128, 192 or 256 bits. Symmetric ciphers are very fast, so they do the heavy work of encrypting files, disks and the data in a web connection.

Why a 128 bit key is enough

A 128 bit key has 2¹²⁸ possible values, about 3.4 × 10³⁸. Even a computer trying a trillion (10¹²) keys every second would need about 1.1 × 10¹⁹ years to try them all. That is roughly 780 million times the age of the universe. Unlike the Caesar cipher, brute force is hopeless.

Asymmetric (public key) encryption

Symmetric encryption has one big problem: how do two people who have never met agree on a secret key without someone overhearing? Asymmetric encryption solves it with a pair of linked keys:

• A public key, which you can share with anyone. Data encrypted with it can only be decrypted with the matching private key.
• A private key, which you never share.

Think of a padlock: you can hand out open padlocks (public keys) to anyone, and they can lock a box with one, but only you have the key (private key) that opens it. Common public key systems include RSA and elliptic curve cryptography. They are much slower than AES, so they are mainly used to agree a key or to make digital signatures.

Both together: how HTTPS works

When you see a padlock in your browser, the connection uses TLS, whose current version is set out in RFC 8446. Your browser and the website first use public key methods to agree a fresh symmetric key and check the site's identity. Then they switch to fast symmetric encryption for the rest of the session. This mix is called hybrid encryption. Try it: this question checks what HTTPS does and doesn't protect.

Where data encryption is used

• Encryption in transit: data moving across a network, such as HTTPS web pages, email between servers and Wi-Fi.
• Encryption at rest: stored data, such as a phone's storage, a laptop's disk or a database backup, so a lost or stolen device gives nothing away.
• End to end encryption: messaging apps where only the sender's and receiver's devices hold the keys, so even the company running the service can't read the messages.
• Payments: card details are encrypted between your device, the shop and the bank.

Encryption vs hashing

Websites should never be able to decrypt your password: they should store a salted hash of it instead, which our Hack a Website course demonstrates. Hashes also chain the blocks in a blockchain, as our guide to blockchain explains.

Encryption and quantum computers

A large enough quantum computer running Shor's algorithm could break RSA and elliptic curve encryption. None exists yet, but data stolen today could be decrypted later, so new methods are being rolled out now. In August 2024, NIST released its first three finalised post-quantum encryption standards, designed to resist quantum attacks. The Quantum Computing course shows how Shor's algorithm works.

Common mistakes

• Thinking encryption stops data being stolen. It makes stolen data unreadable; it doesn't prevent the theft.
• Confusing encryption with hashing. Encryption can be reversed with the key; hashing can't.
• Thinking the cipher must be secret. Good ciphers are public. The key must be secret.
• Reusing a one-time pad. Using the key twice destroys its perfect security.
• Thinking HTTPS means a site is trustworthy. It means the connection is encrypted, not that the site is honest.
• Mixing up the keys. Encrypt with the receiver's public key; only their private key decrypts.

Read next

Computer Science · NetworksTLS encryption: how TLS and SSL keep HTTPS secureHow TLS encryption works: SSL vs TLS, the TLS handshake, certificates, symmetric and asymmetric keys, and a Diffie-Hellman key exchange worked through.