33.3 Symmetric Encryption
Symmetric encryption uses one shared key to encrypt and decrypt. It is fast, so it protects bulk data.
- AES (Advanced Encryption Standard) with 128 or 256-bit keys is the standard today. Modes matter: AES-GCM gives encryption plus integrity; avoid ECB mode, which leaks patterns.
- ChaCha20-Poly1305 is a fast modern alternative, common on mobiles.
- Old and unsafe: DES, 3DES, RC4.
echo "Kolhapur shop sales: 4,20,000" > secret.txt
openssl enc -aes-256-cbc -pbkdf2 -salt -in secret.txt -out secret.enc # asks for a passphrase
openssl enc -d -aes-256-cbc -pbkdf2 -in secret.enc -out back.txt
gpg -c secret.txt # symmetric with GPG, creates secret.txt.gpg
The big problem with symmetric crypto is key exchange: how do two people who have never met share the key safely? Asymmetric crypto solves that.
Ravindra Bagale's Tip
Even strong encryption is useless if you keep the key right next to the file – like locking a door and hanging the key on it. Keep keys separate: AWS KMS, Secrets Manager, a password manager. And never build "my own encryption algorithm" – use tested standards (AES).
Ravindra Bagale's Tip – मराठी
Encryption strong असले तरी key file सोबतच ठेवली तर काही उपयोग नाही – जसे कुलूप लावून चावी दरवाज्यावर लटकवली. Keys वेगळ्या ठेवा: AWS KMS, Secrets Manager, password manager. आणि "माझा स्वतःचा encryption algorithm" कधीच बनवू नका – tested standards (AES) वापरा.
Ravindra Bagale's Tip – हिंदी
Encryption strong हो फिर भी key file के साथ ही रखी तो कोई फ़ायदा नहीं – जैसे ताला लगाकर चाबी दरवाज़े पर लटका दी. Keys अलग रखो: AWS KMS, Secrets Manager, password manager. और "अपना खुद का encryption algorithm" कभी मत बनाओ – tested standards (AES) इस्तेमाल करो.
Lab
Encrypt a file with openssl enc -aes-256-cbc -pbkdf2, send the .enc file to a partner in class, and share the passphrase by a different channel (spoken, not in the same message). Ask them to decrypt it. Then try decrypting with a wrong passphrase and note the error.