Skip to content

🔑 07-02: Symmetric Encryption Basics

📌 What Is Symmetric Encryption?

Symmetric encryption is the simplest form of encryption: one shared secret key is used both to scramble the data (encryption) and unscramble it (decryption).

  • Plaintext → the original, readable data
  • Ciphertext → the scrambled, unreadable output
  • Key → the secret value that controls exactly how the scrambling happens
plaintext + key  --[encrypt]-->  ciphertext
ciphertext + key --[decrypt]-->  plaintext

💡 Think of it like a physical lockbox with a single key: whoever has a copy of that key can both lock it and unlock it. If two people both have the same key, they can exchange locked boxes freely — but anyone without the key just sees a locked box they can't open.

The core requirement: both parties must already possess the identical secret key before they can communicate. That requirement turns out to be a much bigger problem than it sounds — more on that at the end of this lesson.

✍️ Building Intuition: A Toy Caesar Cipher

Long before computers, people used simple substitution ciphers. The Caesar cipher is a classic teaching example: shift every letter forward in the alphabet by a fixed number of positions. That fixed number is the "key."

Worked Example (key = 3)

Plain A B C D E ... X Y Z
Cipher D E F G H ... A B C

Encrypting the word HELLO with key 3:

H -> K
E -> H
L -> O
L -> O
O -> R

Ciphertext: KHOOR

Decrypting is the same operation in reverse — shift backward by 3:

K -> H
H -> E
O -> L
O -> L
R -> O

Plaintext: HELLO

💡 Notice the pattern that defines all symmetric encryption: the same key (3) is used to both encrypt and decrypt, just applied in opposite directions. Anyone who knows the key can do both operations instantly. Anyone who doesn't know the key has to guess it — and with only 25 possible shifts, that's trivial to brute-force. This is why the Caesar cipher is a teaching tool, not real security: the "key space" is far too small, and the algorithm leaks patterns (letter frequency) that a human can spot by eye.

Modern symmetric ciphers solve both problems: they use enormous key spaces (billions of billions of billions of possible keys) and mix the data so thoroughly that no statistical pattern survives.

🏛️ From Caesar to DES: A Real Algorithm

The first widely adopted modern symmetric cipher was DES (Data Encryption Standard), published by the U.S. government in 1977. DES is worth knowing not because you should use it today (you shouldn't — it's obsolete), but because it established the blueprint that later ciphers, including AES, still follow.

Property DES
Key size 56 bits (effectively)
Block size 64 bits
Structure Feistel network — data is split in half and repeatedly mixed through 16 "rounds"
Status today Broken — a 56-bit key can be brute-forced in hours on modern hardware

Why DES Failed

A 56-bit key means there are 2^56 (about 72 quadrillion) possible keys. That sounded enormous in 1977. By the late 1990s, purpose-built hardware ("DES cracker" machines) could try every single key in under a day. The lesson: key size has to keep growing as computing power grows, which is exactly why DES's successor doubled down on key size.

💡 A short-lived patch called 3DES (Triple DES) — running DES three times with different keys — extended its life for a while, but it's slow and is also now deprecated. DES's real legacy is that it proved out the block-cipher design pattern that AES (covered next in 07-03: AES & Block Cipher Modes) replaced it with in 2001.

🚧 The Key Distribution Problem

Symmetric encryption is fast and simple, but it has one deep, unavoidable flaw: before you can encrypt anything, both sides need the same secret key — and they need to get that key to each other without an attacker intercepting it.

Think through the problem:

  1. Alice wants to send Bob a secret message over the internet.
  2. They agree to use symmetric encryption — great, but they don't have a shared key yet.
  3. How does Alice get the key to Bob?
  4. Emailing it? An attacker sniffing the network (Module 03) reads the key in plaintext.
  5. Posting it on a public server? Same problem.
  6. Meeting in person to exchange a USB drive? Works, but doesn't scale to "billions of people talking to millions of websites they've never met."

💥 This is the key distribution problem, and it's the single biggest limitation of symmetric encryption: the security of the encrypted channel depends entirely on a secure channel you don't have yet to share the key in the first place.

Approach Problem
Send key over the same network Attacker sniffs it (Module 03: packet sniffing/MITM)
Meet in person Doesn't scale — impossible for "any browser talking to any website"
Use the same key forever, for everyone One leak compromises every past and future message

💡 This single problem is the reason asymmetric encryption (public-key cryptography) exists at all. Instead of requiring a shared secret in advance, asymmetric encryption lets two strangers establish secure communication over a network that an attacker is actively watching — no prior meeting required. That's the subject of 07-04: Asymmetric Encryption (RSA), and the specific technique for deriving a shared symmetric key over an open channel is 07-05: Diffie-Hellman Key Exchange.

In practice, modern protocols use both: asymmetric encryption to solve the key distribution problem, then a fast symmetric cipher (like AES) to actually encrypt the bulk of the data. You'll see this exact combination again when you study TLS in Module 09.

📌 Key Takeaways

  • Symmetric encryption uses one shared secret key for both encryption and decryption.
  • The Caesar cipher demonstrates the core mechanic (same key, reversed operation) but is trivially breakable due to its tiny key space and pattern leakage.
  • DES was the first modern standardized symmetric cipher — a 64-bit block cipher with a 56-bit key, now broken by brute force and obsolete.
  • Symmetric ciphers are fast and simple to implement — which is why they're still used for encrypting bulk data today (via AES, not DES).
  • The key distribution problem is symmetric encryption's fundamental weakness: both parties need the identical key beforehand, and getting it to each other securely is itself a hard problem.
  • Sending the key over the same untrusted network defeats the purpose — an attacker who can sniff traffic (Module 03) can simply steal the key.
  • This limitation directly motivates asymmetric encryption and Diffie-Hellman key exchange, covered in the next lessons.
  • Real-world systems (including TLS) combine both worlds: asymmetric crypto to establish a shared key safely, then symmetric crypto (AES) to encrypt the actual traffic efficiently.