Symmetric Encryption

Symmetric encryption is a method for making data unreadable to outsiders. There is one secret that both sides must know: the key. This isn’t a jagged piece of metal, but a very long random number, usually 128 or 256 digits in binary. Whoever sends a message uses this key to turn it into scrambled gibberish. Whoever receives it runs the exact same calculation in reverse with the same key and gets back the original text. “Symmetric” therefore means: the same key works in both directions. Its counterpart works with two different keys — more on that later.

The key both sides must know

Symmetric methods are the workhorse of digital security. They are extremely fast because, at their core, they only perform simple operations on bits. Modern processors even have built-in special instructions for this. That’s why your phone can encrypt its entire storage in real time without you noticing a thing. Video streams and large downloads also run over encrypted connections this way.

The weak point isn’t the math, but the logistics. Both sides need the same key before they can talk securely. How do you transmit it if the channel isn’t secure yet? This problem is called key exchange, and for decades it was the central headache of cryptography. In the past, couriers carried codebooks around; that obviously doesn’t work on the internet.

A second problem is the sheer number of keys. If everyone in a group wants to communicate confidentially with everyone else, each pair needs its own key. With 10 people, that’s 45 keys; with 1,000 people, it’s already almost half a million. What’s more, a single leaked key exposes all the data protected with it.

From AES to the mode of operation

The most important algorithm in use today is AES, the Advanced Encryption Standard. It breaks data into blocks of 16 bytes and pushes each block through several rounds. In each round, bytes are substituted, permuted, mixed, and combined with part of the key. With a 256-bit key, there are 14 such rounds. Any single round alone would be easy to crack, but the repetition makes the result practically irreversible.

An attacker without the key can only guess. With 256 bits, there are around 10 to the power of 77 possibilities — more than there are atoms in our galaxy. All the computers in the world combined couldn’t get through that, no matter how long they computed. Security vulnerabilities therefore almost always arise from implementation errors, not from broken algorithms.

Also important is the mode of operation — the rule for how individual blocks are chained together. If each block is encrypted independently, identical plaintext blocks produce identical ciphertext blocks. Patterns in an image then remain visible. Good modes therefore mix in a random value and append a checksum that reveals tampering. Modern systems solve the key problem with asymmetric encryption: there, a public key and a private key exist, and they’re used only to securely agree on a symmetric key.

Wherever the padlock icon appears

Every time the little padlock appears next to the address in your browser, symmetric encryption is working in the background. When the connection is established, browser and server negotiate a fresh shared key. After that, all traffic runs symmetrically, because that’s fast enough for videos and large pages. The same pattern is found in WhatsApp, Signal, and encrypted email.

You also encounter this method constantly offline. Disk encryption on Windows and macOS uses AES, as does the storage in your smartphone. A password-protected ZIP archive, a Wi-Fi password, an encrypted USB stick: always the same basic idea. Your password is mathematically converted into a key in the process.

In the news, symmetric methods usually come up when something goes wrong. A provider stores keys unencrypted right next to the data, or a developer writes one directly into the program code. Debates about end-to-end encryption are almost always about the question of who holds the keys. The algorithm itself is rarely the point of contention.