<< Back to article

Encryption

Encryption transforms plaintext into ciphertext using an algorithm and a key, ensuring that only authorised parties can read the data. It is the cornerstone of digital security, protecting communications, stored data, and authentication mechanisms.

Symmetric Encryption

Symmetric encryption uses the same key for both encryption and decryption.

Common Algorithms

  • AES (Advanced Encryption Standard): The global standard. Key sizes: 128, 192, 256 bits. Modes: ECB (insecure), CBC, GCM (authenticated), CTR.
  • ChaCha20: Stream cipher, faster than AES on devices without AES-NI. Often paired with Poly1305 for authentication (ChaCha20-Poly1305).
  • Blowfish/Twofish: Older algorithms, still secure but less common.

Modes of Operation

  • ECB (Electronic Codebook): Each block encrypted independently. Insecure—reveals patterns.
  • CBC (Cipher Block Chaining): Each block XORed with the previous ciphertext block. Requires an IV.
  • GCM (Galois/Counter Mode): Counter mode with authentication. Provides confidentiality and integrity. Recommended for TLS and disk encryption.
  • CTR (Counter): Turns a block cipher into a stream cipher. Parallelisable.

Linux Tools

openssl enc -aes-256-gcm -salt -in plain.txt -out encrypted.bin
openssl enc -d -aes-256-gcm -in encrypted.bin -out plain.txt

gpg --symmetric --cipher-algo AES256 plain.txt
gpg --decrypt plain.txt.gpg

cryptsetup open --type luks /dev/sda1 encrypted

Asymmetric Encryption

Asymmetric encryption uses a key pair: a public key for encryption and a private key for decryption.

Common Algorithms

  • RSA: Based on integer factorisation. Key sizes: 2048, 4096 bits.
  • ECDSA/ECDH: Elliptic Curve Cryptography. Smaller keys, same security as RSA.
  • Ed25519: Modern EdDSA signature scheme. Fast, secure, short keys.

Use Cases

  • Key exchange: Agree on a symmetric key over an insecure channel (Diffie-Hellman, ECDH).
  • Digital signatures: Verify authenticity and integrity.
  • Encryption: Encrypt small pieces of data (e.g., session keys).

Linux Tools

# Generate RSA key pair
openssl genrsa -out private.pem 4096
openssl rsa -in private.pem -pubout -out public.pem

# Encrypt with public key
openssl rsautl -encrypt -pubin -inkey public.pem -in secret.txt -out encrypted.bin

# Decrypt with private key
openssl rsautl -decrypt -inkey private.pem -in encrypted.bin -out secret.txt

# Generate Ed25519 key
ssh-keygen -t ed25519 -f mykey

Hybrid Encryption

In practice, asymmetric encryption is used to exchange a symmetric key, which is then used for bulk encryption. This combines the key exchange benefits of asymmetric with the speed of symmetric.

Key Management

  • Key storage: Store private keys securely (hardware tokens, encrypted files).
  • Key rotation: Regularly change keys to limit exposure.
  • Key derivation: Derive keys from passwords using PBKDF2, Argon2, or scrypt.
  • Hardware Security Modules (HSM): Dedicated hardware for key storage and cryptographic operations.