Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
Encryption and Secrets  ›  Lesson

Symmetric Encryption

Symmetric 12 minSymmetric encryption uses one shared secret key to both lock and unlock data, so it is fast enough for bulk data but only as safe as the place the key is kept.

Symmetric Encryption

Every night Tiffin's pipeline dumps the orders database to a file and copies it to cloud storage. That file holds names, addresses and phone numbers. If the storage is ever exposed, the backup should be useless to whoever finds it. That is a job for symmetric encryption, and the whole job depends on one question.

The rule

One key locks and unlocks, so guard the key harder than the data.

In symmetric encryption the same secret key turns readable plaintext into scrambled ciphertext and back again. The standard choice today is AES (Advanced Encryption Standard), usually with a 256-bit key.

# encrypt the backup with a key from a separate, protected store
openssl enc -aes-256-cbc -pbkdf2 -in orders.sql -out orders.sql.enc -pass file:/run/keys/backup.key

Symmetric encryption is fast, which is why it protects bulk data: disks, database files, backups, and the traffic inside a TLS connection once it is set up.

Its weakness is the key. Everyone who needs to decrypt needs the same key, so the key must be created, stored, shared and eventually replaced safely. Encryption does not remove the secret; it shrinks a big secret (the data) into a small one (the key).

Two rules keep you out of trouble:

  • Use a standard, authenticated mode such as AES-GCM through a well-known library. "Authenticated" means tampering with the ciphertext is detected on decrypt, which protects integrity as well as confidentiality. The openssl line above is fine for a quick demo; in application code prefer an authenticated mode.
  • Never invent your own cipher or mix your own scheme. Home-made cryptography fails in ways you cannot see.

The shortcut

Whenever you see "encrypted", ask: "Where does the key live, and who can reach it?" If the answer is "the same place as the data", the encryption is decoration.

Tiffin's nightly backupStep 1 of 4

  1. The data

    orders.sql contains customer details. Confidentiality matters.

Drills

Answer fast — trust the rule.

quick drill

What defines symmetric encryption?

quick drill

What is the main practical difficulty of symmetric encryption?

quick drill

Tiffin stores backup.key in the same bucket as the encrypted backups. What does the encryption protect against?

quick drill

Why prefer AES-GCM over a plain encryption mode in application code?

Remember

  • One key locks and unlocks, so guard the key harder than the data.
  • Ask "where does the key live, and who can reach it?"
  • Use standard authenticated modes like AES-GCM; never invent your own.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainWhere does the key live?

Tiffin encrypts its nightly database backups with AES-256 and uploads them to a storage bucket. The key file is uploaded to the same bucket so restores are easy. Explain what protection this gives, what it does not, and how you would fix it.