Scrambling with a key
Encryption is the process of turning readable information, called plaintext, into an unreadable scramble, called ciphertext, using a mathematical procedure and a secret value known as a key. Without the right key, the ciphertext should look like meaningless noise. With it, the original can be recovered by reversing the process, which is called decryption.
A simple old-fashioned example is a substitution cipher in which each letter is shifted a few places along the alphabet. The shift amount is the key. That kind of cipher is trivially easy to break today. Modern encryption uses the same basic structure, a method plus a key, but relies on mathematics designed so that, without the key, trying every possibility would take an impractically long time with current technology.
An important principle is that the method itself is not secret. Well-regarded algorithms are published and examined by many experts for years. Security rests on keeping the key secret, not on hiding how the scheme works.
Two main kinds of encryption
Shared-key (symmetric) encryption. The same key locks and unlocks the data. It is fast and well suited to scrambling large amounts of information, like files or a stream of video. The difficulty is getting the key safely to the other person: if you must send the key over an insecure channel, it could be copied.
Paired-key (asymmetric) encryption. Each person has a pair of linked keys: a public key that can be shared widely and a private key that is kept secret. Something locked with the public key can only be unlocked with the matching private key. An everyday analogy is a padlock that anyone can snap shut but only its owner can open. This solves the key delivery problem, because you can send your public key openly. It is slower, so in practice systems often use it briefly to agree on a shared key and then switch to the faster symmetric method.
This combination is behind much of what happens when you load a secure website. Your browser and the site use paired-key techniques to establish a shared key, and then use that key to protect the rest of the session. The padlock or HTTPS indicator in your browser reflects this process.
Encryption in transit and end to end
Where the keys live determines who can read a message.
In transit. Your message is encrypted between your device and a service’s server, and decrypted there. This protects against people who might observe the connection, for example on public Wi-Fi. But the service itself can read the message, and it may be stored in readable form on its systems.
End-to-end. Only the sender and the intended recipient hold the keys. The service passes along the scrambled message but cannot read it. This offers stronger privacy from the provider, though it also means the provider cannot recover your messages if you lose access, and some features, such as server-side search, are harder to offer.
When an app advertises end-to-end encryption, it is worth reading what it actually covers. Some apps encrypt only certain kinds of conversations, or back up messages in a form that is not protected the same way.
Encryption at rest
Encryption also protects data stored on a device. If a phone or laptop with an encrypted drive is lost, the files are not readable without the unlock credentials. This is one reason that screen locks and strong passcodes matter: the passcode is often part of what protects the key. Password managers use the same idea, as described in the article on how they fit into security.
Other uses
Encryption underpins digital payments and online banking, protecting card and account details as they travel. It also appears alongside related ideas such as cryptographic hashing, which produces fixed fingerprints of data rather than reversible scrambles; hashing is used, for example, in checking that a file has not been altered. They are distinct tools, though they are often combined.
What encryption does not do
It is powerful, but it is not magic.
- It does not protect an unlocked or compromised device. If someone controls your phone or can see your screen, they can read messages after decryption. Keeping devices updated and locked matters.
- It does not hide everything. Even with strong encryption, information about the communication, such as who contacted whom and when, may still be visible to the service or the network.
- It does not stop you being fooled. If you send a secret to an impostor, encryption just delivers it securely to the wrong person. This is why phishing scams remain effective.
- Keys can be lost or stolen. Weak passwords, poorly kept keys or flawed implementations are far more common causes of failure than the mathematics being broken.
Looking ahead
Some of today’s paired-key methods rely on math problems that a sufficiently large quantum computer could in principle solve much faster. Researchers are developing replacements, covered under post-quantum cryptography. How soon this will matter is uncertain, and everyday users do not need to do anything now except keep their software up to date so that improvements arrive when they are ready.
Practical takeaways
Use services that encrypt connections, which today is most of them. Where privacy from the provider matters to you, look for genuine end-to-end encryption and read what it covers. Lock your devices with a strong passcode, enable device encryption if it is not already on, and keep software current. Encryption works best as one layer in the broader set of habits described in the cyber safety guide.