Encryption
Encryption is the transformation of readable data, called plaintext, into an unreadable form, called ciphertext, using an algorithm and a secret value known as a key, so that only someone holding the correct key can reverse the process. It provides confidentiality: data that is intercepted on a network or stolen from a disk stays meaningless without the key. Modern encryption is public mathematics, published and attacked by researchers for years, and the secrecy lies entirely in the key, a principle stated by Auguste Kerckhoffs in 1883.
Symmetric encryption uses one shared key for both encrypting and decrypting, and it is fast enough to protect bulk data. The dominant standard is the Advanced Encryption Standard (AES), selected by NIST in 2001 from the Rijndael design of Joan Daemen and Vincent Rijmen and published as FIPS 197, with keys of 128, 192 or 256 bits. It replaced the Data Encryption Standard (DES), adopted in 1977, whose 56-bit key became too short. AES is a block cipher, handling 128-bit blocks, so it is used inside a mode of operation; modes such as GCM also authenticate the data, detecting tampering, while the old ECB mode leaks patterns because equal blocks encrypt identically. The weakness of symmetric schemes is the key distribution problem: two parties who have never met need some safe way to agree on a secret.
Asymmetric (public-key) encryption solves that problem with a mathematically linked key pair: a public key that can be shared freely and a private key that is never shared. Whitfield Diffie and Martin Hellman published the idea and the Diffie-Hellman key exchange in 1976, letting two parties derive a shared secret over an open channel. In 1977 Ron Rivest, Adi Shamir and Leonard Adleman devised RSA, whose security rests on the difficulty of factoring the product of two large primes, and elliptic-curve cryptography later offered comparable strength with much smaller keys. Asymmetric operations are far slower than symmetric ones, so real systems combine them: TLS, the protocol behind HTTPS, uses public-key methods to authenticate the server and agree on a session key, then switches to symmetric encryption such as AES-GCM for the traffic.
Where encryption is applied matters as much as which algorithm is used: data in transit is protected while moving between systems, and data at rest is protected while stored. In-transit protection means TLS for web traffic, SSH for remote logins and VPN tunnels; at-rest protection means full-disk encryption on laptops and phones, and encrypted databases and cloud object storage. End-to-end encryption goes further, so that only the communicating endpoints hold the keys and even the service provider cannot read messages. Each layer defends against a different threat: disk encryption does nothing against malware running on a logged-in machine, and TLS protects data only until it reaches the server.
Key management is the hard part in practice, and most real failures are about keys rather than ciphers. Keys must be generated from strong randomness, stored away from the data they protect, rotated, backed up and destroyed on schedule. Hardware security modules and cloud key management services keep keys in tamper-resistant devices and let applications request cryptographic operations without ever seeing the key. Typical mistakes include hard-coding a key in source code, committing it to a repository, using a home-made algorithm, and losing the only key, which makes the data permanently unrecoverable. Encryption is also distinct from hashing, which is one-way and has no key to reverse, and from encoding such as Base64, which provides no secrecy at all. Researchers are now standardizing post-quantum algorithms because a large quantum computer could break RSA and Diffie-Hellman.
Read encryption as confidentiality reduced to a key: strong, public algorithms such as AES and RSA make the math effectively unbreakable, so what is left to protect is the key, where it travels, where it rests and who can ask for it to be used.