What encryption does and does not do
Data travelling across a network can be intercepted, and no realistic amount of care prevents that entirely. Encryption accepts the interception and makes it worthless: the data is scrambled so that anyone reading it sees nothing meaningful.
It is important to be precise about what this achieves. Encryption does not stop data being intercepted, stolen or deleted. It stops the interceptor understanding what they took. That distinction is examined directly and a great many answers lose the mark by claiming it prevents theft.
| Term | Meaning |
|---|---|
| Plaintext | the original readable data |
| Ciphertext | the scrambled result after encryption |
| Key | the secret value controlling the scrambling |
| Algorithm | the method — usually public knowledge |
| Encryption | plaintext → ciphertext |
| Decryption | ciphertext → plaintext, using the key |
A simple cipher, and why it is weak
The Caesar cipher shifts each letter a fixed number of places through the alphabet. A shift of 3 turns A into D and MEET into PHHW. The shift is the key, and reversing it recovers the message.
It illustrates the structure of every cipher — plaintext, key, ciphertext — and also why key length matters. There are only 25 useful shifts, so an attacker can simply try all of them in a few seconds. That is a brute force attack, and defending against it is entirely a matter of having too many possible keys to try.
Set the key to 0 and the ciphertext is the plaintext. Knowing the method is a shift cipher does not read the message — an attacker also needs the key. That principle holds for modern encryption too; only the key count changes.
Why the algorithm is published deliberately
Modern encryption algorithms are public, examined by anyone who wishes to, and used worldwide. Secrecy rests entirely on the key. This is deliberate: an algorithm kept secret has been checked by only a few people, and a weakness nobody noticed is far more dangerous than one found and fixed in public. Security through obscurity is not security.
Symmetric and asymmetric encryption
Symmetric encryption uses the same key to encrypt and to decrypt. It is fast and well suited to large amounts of data, but it has one serious problem: the key itself must reach the recipient somehow, and any channel safe enough to send the key on would have been safe enough to send the message on.
Asymmetric encryption solves that with a pair of keys. The public key is published freely and encrypts; the private key is never shared and decrypts. Anyone can send you a message nobody else can read, with no secret ever having been exchanged.
The cost is speed — asymmetric encryption is far slower. So real systems use both: asymmetric encryption to exchange a symmetric key safely, then symmetric encryption for the actual data.
The public key cannot decrypt
It is tempting to assume that a key which locks can also unlock. In asymmetric encryption it cannot: the public key encrypts only, and even the person who encrypted the message cannot read it back. That one-way property is exactly what makes publishing the key safe.
Where encryption is used
The syllabus expects real applications rather than the theory alone.
HTTPS encrypts everything between a browser and a website, which is why payment pages must use it — and why browsers now mark plain HTTP as insecure regardless of what the page does. Disk encryption protects data at rest, so a stolen laptop yields nothing without the password. Messaging apps use end-to-end encryption, meaning even the company operating the service cannot read the messages. And wireless networks encrypt traffic so that anyone within range cannot simply read it out of the air.
Before you leave this chapter
- Encryption does not prevent interception — it makes the intercepted data meaningless.
- Plaintext + key + algorithm → ciphertext. The algorithm is public; only the key is secret.
- A short key is vulnerable to brute force — trying every possibility.
- Symmetric uses one shared key and is fast; asymmetric uses a public/private pair and needs no shared secret.
- Real systems use asymmetric encryption to exchange a symmetric key, then symmetric for the data.
What makes a key strong
Since the algorithm is public, the entire security of an encrypted message rests on the key being impractical to guess. Two things determine that.
The first is length. Each additional bit doubles the number of possible keys, so the search space grows exponentially: a 56-bit key has about 7 × 10¹⁶ possibilities and can now be exhausted, while a 256-bit key has more possibilities than there are atoms in the observable universe.
The second is unpredictability. A long key generated from a dictionary word or a birthday is not a random key, and an attacker will try likely values long before resorting to brute force. This is why password advice emphasises unpredictability as much as length.
Why encryption still fails in practice
Modern encryption is essentially never broken by attacking the mathematics. It fails because a key was stored somewhere unprotected, a user was tricked into revealing a password, or data was read before it was encrypted or after it was decrypted. The strongest cipher in the world protects only the journey — which is why encryption always appears alongside the other security measures rather than instead of them.