Encryption

Symmetric encryption uses the same secret key to encrypt and decrypt. Both the sender and the receiver must have a copy of this key.

How it works

1. The sender and receiver agree on a secret key ahead of time, through some secure channel.
2. The sender uses the key to encrypt the plaintext into ciphertext.
3. The ciphertext is transmitted over the network.
4. The receiver uses the same key to decrypt the ciphertext back into plaintext.
5. Anyone intercepting the ciphertext without the key sees only scrambled bytes.

The key-sharing problem

Symmetric encryption is fast and simple, but it has one serious weakness: how do you get the secret key to the other person in the first place?

You cannot send the key over the same network you want to protect, because the insecure link would expose the key just as it exposes the data. Possible ways to share a symmetric key:

• Meet in person and read it out loud or hand over a piece of paper.
• Send it by post in a sealed envelope.
• Phone the other person and read the key digit by digit.
• Use an algorithm (such as Diffie-Hellman key exchange) that lets both ends derive the same key without sending it explicitly.
• Use asymmetric encryption to send the symmetric key the first time (the basis of HTTPS).

If an attacker ever gets a copy of the shared key, every past and future message can be decrypted.

When symmetric encryption is used

• Wi-Fi (WPA2 uses a symmetric key derived from the SSID and password)
• Encrypted file storage on disk
• The bulk of every HTTPS connection (after the initial key exchange)
• VPN tunnels between two known parties