Symmetric Encryption — One Key

One key to rule both ends

Symmetric encryption is the simplest model: the same key is used to encrypt and decrypt. Alice and Bob share a secret key. Alice encrypts with it. Bob decrypts with it. It's fast, efficient, and mathematically well-understood. The problem isn't the encryption — it's getting the shared key to Bob without Eve intercepting it.

<div style={{ marginTop: "1.5rem", marginBottom: "1.5rem" }}> !Symmetric Encryption simplified </div>

How it works

Symmetric ciphers transform plaintext into ciphertext using mathematical operations that can only be reversed with the key.

Modern symmetric ciphers operate on blocks of data (block ciphers) or on a continuous stream (stream ciphers).

Block ciphers split the input into fixed-size chunks (e.g., 128 bits) and process each block through multiple rounds of substitution and permutation operations.

Stream ciphers generate a keystream — a sequence of pseudo-random bits derived from the key — and XOR it with the plaintext bit by bit.

AES — the current standard

Advanced Encryption Standard (AES) was selected by NIST in 2001 after a public competition. It's now the global standard for symmetric encryption.

<div style={{ marginTop: "1.5rem", marginBottom: "1.5rem" }}> !AES Design </div>

AES operates on 128-bit blocks with key sizes of 128, 192, or 256 bits. It runs through 10–14 rounds of operations including:

SubBytes — non-linear substitution using a fixed lookup table
ShiftRows — cyclic rotation of rows
MixColumns — linear transformation of columns
AddRoundKey — XOR with a round-derived key

The combination of these operations ensures that every bit of output depends on every bit of input and every bit of the key. Change one bit anywhere, and roughly half the output bits change unpredictably — this is called the avalanche effect.

💡

AES-256 with a random key is considered computationally unbreakable. A brute-force attack trying every possible 256-bit key would require more operations than there are atoms in the observable universe. The math is settled — the weak points are always implementation and key management, not the algorithm itself.

The key distribution problem

Symmetric encryption's fundamental weakness: both parties need the same key, and they need to have exchanged it securely before communication can begin.

In practice, this means: - Meeting in person to exchange keys (impractical at scale) - Using a trusted third party (creates a single point of failure) - Using a secure channel that already exists (circular — if you had that, you wouldn't need this)

For thousands of years, this problem had no clean solution. The key had to travel separately from the message — through couriers, diplomatic pouches, sealed envelopes.

This is why asymmetric encryption (the next lesson) was such a breakthrough. It solved key distribution entirely.

Where symmetric encryption still dominates

Despite the key problem, symmetric encryption isn't going away. It's vastly faster than asymmetric encryption — often 1,000x or more.

In practice, systems use both:

1. Asymmetric encryption to securely exchange a symmetric key 2. Symmetric encryption (AES) for all actual data

When you connect to a website via HTTPS, your browser and the server use asymmetric cryptography to agree on a shared session key — then immediately switch to AES for the rest of the conversation. The heavy asymmetric work happens once; the fast symmetric work handles everything else.

This pattern — called a hybrid cryptosystem — is how TLS, Signal, and virtually every real-world secure channel works.