Home / Knowledge hub / Symmetric encryption
Knowledge hub
Symmetric encryption
Encryption where the same secret key locks and unlocks the data.
What it means
Symmetric encryption uses a single secret key for both locking and unlocking data. Whoever holds the key can read the data, and whoever lacks it sees only noise. AES is the standard algorithm and is used almost everywhere.
It is fast and well understood, which makes it the workhorse for encrypting large amounts of data. Its weakness is not the maths but the sharing: both sides need the same key, and anyone who gets a copy has all the same power.
Why it matters
It protects the data you cannot afford to lose: database fields, backups, files in cloud storage and the body of every HTTPS connection. When it is done well, a stolen disk or backup is useless without the key.
When it is done badly, the encryption is decoration. A key stored beside the data, a mode that does not detect tampering, or a key shared by every customer turns a strong algorithm into a false sense of safety, and the breach notice still has to go out.
How it shows up
You meet it in encryption at rest, session cookies that are encrypted, signed and sealed payloads, and the bulk part of TLS. The key is usually held in a key management service, and the app asks that service to encrypt or decrypt.
The repeating mistakes are about the key and the mode. A key hardcoded in source. Old modes like ECB that leak patterns. A reused initialisation vector. Encryption without an integrity check. Check where the key lives and whether the mode is authenticated, such as AES-GCM.
Questions people ask
Symmetric encryption, answered
What is the difference between symmetric and asymmetric encryption?
Symmetric uses one shared key and is fast. Asymmetric uses a public and private pair and is slower but needs no shared secret in advance.
Most systems use asymmetric methods to agree a key, then symmetric encryption for the data.
Is AES secure?
Yes. AES, standardised by NIST in FIPS 197, has no practical attack against it when used correctly with a 128, 192 or 256-bit key.
Failures nearly always come from key handling or the wrong mode, not from AES itself.
How long should a symmetric key be?
Use at least 128 bits, and 256 bits where policy or long-term protection calls for it. Both sizes are approved by NIST.
The key must come from a proper random source, not from a password typed in or a timestamp.
Where should the key be kept?
Away from the data it protects, in a key management service or hardware module, with rotation and access logs.
If the key and the encrypted data sit in the same bucket or repository, anyone who can read one can read both.
Does encrypting data stop it being modified?
Not by itself. Plain encryption hides content but may allow an attacker to flip bits without being noticed.
Use an authenticated mode so tampering is detected and the data is rejected.
Sources
Where this comes from
Related
Terms that sit next to this one
AES-GCM
A widely used encryption mode that also detects tampering with the data.
Public key cryptography
Encryption with a pair of keys: one shared openly, one kept private.
Encryption at rest
Stored data scrambled so a stolen disk is useless without the key.
Initialisation vector (IV)
A starting value that makes the same data encrypt differently each time.
Key rotation
Replacing a credential on a schedule so a leaked one has a short life.
Is the lock or the key weaker?
Hardcoded keys, exposed secrets and data that was meant to be encrypted but is readable through the app are things we test, and each finding shows what we actually read. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.