Encryption Algorithms

Introduction to Encryption

Encryption is the process of converting plaintext into ciphertext to protect data confidentiality. Encryption algorithms are fundamental to modern cybersecurity, enabling secure communication, data protection, and privacy. Understanding encryption algorithms is crucial for anyone working with secure systems, cryptography, or data protection.

This chapter covers popular cryptographic algorithms, each serving different purposes:

• Symmetric Encryption: AES, DES, same key for encryption and decryption
• Asymmetric Encryption: RSA, different keys for encryption and decryption
• Hash Functions: SHA, MD5, one-way functions for integrity and fingerprinting

A note on terminology: hash functions are not encryption. Encryption is reversible and takes a key; hashing is neither. They are grouped here because they are cryptographic primitives you will use together, not because hashing is a kind of encryption. Confusing the two leads directly to the mistake of "encrypting" passwords, or expecting to recover data from a hash.

Brief History of Cryptography

Cryptography as a scientific discipline began during the Second World War, but its practical roots go back thousands of years. Julius Caesar's substitution cipher (each letter replaced with the letter three positions later in the alphabet) is documented in Suetonius around 100 CE. The Arabic mathematician Al-Kindi wrote the first known treatise on cryptanalysis in the 9th century, introducing the frequency analysis technique that would break substitution ciphers for the next thousand years. Vigenère's polyalphabetic cipher (1553) held up against frequency analysis for three centuries before Charles Babbage broke it in 1854. The rotor-based Enigma machines of the 1930s and 1940s were the first widespread mechanical ciphers, and breaking them at Bletchley Park was the founding achievement of modern cryptanalysis and, indirectly, of computer science itself.

The revolution that made modern cryptography possible was Claude Shannon's 1949 paper "Communication Theory of Secrecy Systems," which took cryptography from an art to a mathematical science. Shannon established the concepts of confusion, diffusion, and perfect secrecy, and gave the first information-theoretic definitions of what "secure" means. Every modern cipher's design is a descendant of Shannon's framework.

The subsequent milestones came in rapid succession. Whitfield Diffie and Martin Hellman published "New Directions in Cryptography" in 1976, introducing the concept of public-key cryptography and the Diffie-Hellman key exchange. Rivest, Shamir, and Adleman published RSA in 1977. NIST standardised DES in 1977 and AES in 2001. The web's TLS/SSL infrastructure was built through the 1990s. And from 2010 onwards, the field has been racing to build post-quantum cryptography before scalable quantum computers become a real threat, a project that reached its first major standards milestones in August 2024 with FIPS 203, 204, and 205.

A pattern worth noticing: the field takes decades to migrate. DES was known to be inadequate by the mid-1990s and was formally replaced by AES in 2001, but was not withdrawn from federal use until 2005. MD5 was broken in 2004 but is still embedded in production systems in 2026. SHA-1 was broken in 2017 and NIST has given until 2030 for the final phase-out. Migration is slow because cryptographic algorithms are baked into infrastructure, certificates, protocols, hardware accelerators, embedded devices, and replacing them requires coordinated action across the entire ecosystem. This is the main reason post-quantum standards were finalised in 2024 despite the quantum threat being decades away: the migration itself will take that long.

The Three Foundational Concepts

All modern cryptography rests on three fundamental building blocks. Understanding what each one does, and, crucially, what it does not do, is more important than memorising the details of any specific algorithm.

Symmetric Encryption: The Speed Layer

Symmetric encryption uses the same key to encrypt and decrypt. AES is the canonical modern example, with ChaCha20 being the standard alternative on hardware without AES acceleration. Symmetric encryption is fast, modern CPUs encrypt AES-256 faster than they can copy memory in some workloads, and it provides confidentiality: an attacker without the key cannot read the plaintext. It does not by itself provide authenticity (an attacker can modify ciphertext in ways that produce plausible-looking decryptions), which is why modern systems always use AEAD modes like AES-GCM that provide both confidentiality and integrity.

The fundamental limitation of symmetric encryption is key distribution: both parties need the same key, and getting it to them securely is itself a cryptographic problem. This is what asymmetric cryptography solves.

Asymmetric Cryptography: The Trust Layer

Asymmetric (public-key) cryptography uses a pair of mathematically related keys: a public key that can be shared freely, and a private key that must be kept secret. Anything encrypted with the public key can only be decrypted with the private key; anything signed with the private key can be verified with the public key. RSA is the classical example; elliptic-curve cryptography (ECDSA, EdDSA, X25519) is the modern default because it provides equivalent security with much smaller keys.

Asymmetric cryptography is slow, hundreds of times slower than symmetric, so it is never used for bulk data encryption. Instead it is used to solve two specific problems: (1) key agreement, where two parties who have never met can derive a shared symmetric key over an open channel, and (2) digital signatures, where a party can prove that a message came from them and has not been tampered with. Every TLS connection uses asymmetric crypto for both key agreement (ECDHE) and authentication (certificate signatures), then switches to symmetric AES-GCM or ChaCha20-Poly1305 for the actual data transfer.

Hash Functions: The Identity Layer

Hash functions take an input of any size and produce a fixed-size fingerprint. They are not encryption, there is no key and they cannot be reversed. But they are the most versatile of the three primitives, appearing in dozens of ways: file integrity checks, content-addressed storage, digital signature construction (you sign the hash of a document, not the document itself), password verification (through KDFs like Argon2), Merkle trees for blockchains, HMAC for authenticated messages, and much more.

A cryptographically secure hash function has three required properties: collision resistance (hard to find two inputs with the same hash), pre-image resistance (hard to find an input matching a given hash), and second-pre-image resistance (hard to find a second input matching a given hash of a known input). Different applications need different properties. When you read "MD5 is broken," it means broken for collision resistance, the other properties still hold. When you read "SHA-256 is secure," it means all three hold.

The Cryptographic Mistakes Everyone Makes

Cryptography is notoriously easy to get wrong. The mathematics is not usually the problem, the primitives on this site have been proven secure through decades of analysis. The problem is that correct use requires understanding what each primitive provides and does not provide, and most breaches happen when someone uses a correct primitive incorrectly. A short list of the mistakes that keep happening:

• "Encrypting" passwords with AES or hashing them with SHA-256. Passwords need a slow, memory-hard KDF (Argon2id, scrypt, bcrypt, or PBKDF2). Reversible encryption of passwords means you can leak them via database dumps; fast hashing means GPUs crack them in hours.
• Reusing a nonce in AES-GCM. Catastrophic. Reveals the XOR of the two plaintexts, and reveals the GCM authentication key so an attacker can forge arbitrary ciphertext. If you cannot guarantee nonce uniqueness, use AES-GCM-SIV instead.
• Rolling your own crypto. Every subtle implementation choice, constant-time comparisons, resistance to cache-timing attacks, correct key erasure, RNG seeding, is a place where hand-rolled code goes wrong. Use a vetted library (libsodium, RustCrypto, Python's cryptography package, Go's crypto/*).
• Comparing MACs or tags with ==. String equality in most languages is timing-variable, it returns as soon as the first differing byte is found. An attacker who can measure timing can iteratively recover the correct MAC one byte at a time. Use a constant-time comparison function.
• Signing hashes with an unauthenticated construction. Never use H(secret || message) as a MAC. It is vulnerable to length-extension attacks on all Merkle-Damgård hashes (MD5, SHA-1, SHA-2). Use HMAC, which is designed to work around this specific weakness.
• Trusting entropy from a non-cryptographic RNG. random.random() in Python and Math.random() in JavaScript are not cryptographic. Use secrets in Python, crypto.getRandomValues() in browsers, os.urandom() as the underlying source.

Encryption Algorithms

Algorithm Comparison

Primitives This Chapter Does Not Cover

The five algorithms above are the classics, but a working system in 2026 needs several primitives that are not among them. They are listed here so you know what to go and read about:

• Elliptic-curve cryptography (ECC): ECDSA and Ed25519 for signatures, ECDH/X25519 for key agreement. Far smaller keys than RSA for equivalent security, a 256-bit curve matches 3072-bit RSA, and much faster.
• Diffie-Hellman key agreement: how two parties derive a shared secret over a public channel. Ephemeral DH (DHE/ECDHE) is what gives modern TLS its forward secrecy.
• ChaCha20-Poly1305: an AEAD stream cipher, faster than AES on hardware without AES-NI. Widely used in TLS and in WireGuard.
• HMAC: the correct way to authenticate a message with a shared secret and a hash function. Never hand-roll H(secret || message).
• Key derivation functions: HKDF for deriving keys from existing key material; Argon2id, scrypt or bcrypt for deriving keys from passwords. These are not interchangeable.

Post-Quantum Cryptography

Every asymmetric algorithm on this page. RSA, and the elliptic-curve schemes above, rests on a problem that a sufficiently large quantum computer solves efficiently. Shor's algorithm factors integers and computes discrete logarithms in polynomial time, which breaks RSA, DH, ECDH and ECDSA at every key size. Increasing the key length does not help.

Symmetric cryptography is far less affected. Grover's algorithm gives only a quadratic speedup on brute-force search, so it notionally halves effective key length: AES-256 retains about 128 bits of security, and SHA-256 remains sound. This is the main reason AES-256 is now preferred over AES-128 for long-lived data.

The threat is not purely future-tense. Harvest-now-decrypt-later means an adversary can record encrypted traffic today and decrypt it once quantum hardware arrives, so anything that must stay confidential for a decade or more is already at risk.

The standards

NIST finalized its first post-quantum standards in August 2024, after an eight-year public competition:

Two standards for signatures is deliberate. ML-DSA is efficient but lattice-based, like ML-KEM; if lattice assumptions were ever broken, SLH-DSA depends only on hash functions and would survive.

What this means in practice

• It has already started. Chrome and Firefox have defaulted to the hybrid key-exchange group X25519MLKEM768 since 2024–25. "Hybrid" means classical X25519 and post-quantum ML-KEM are both run and their secrets combined, so the connection is safe unless both are broken. Your browser is very likely negotiating this right now.
• Timelines are set. NIST IR 8547 (draft) proposes deprecating RSA-2048 and 256-bit ECC after 2030 and disallowing them after 2035. NSA's CNSA 2.0 suite requires post-quantum algorithms for national security systems on a similar schedule.
• Key exchange first, signatures later. Key exchange is urgent because of harvest-now-decrypt-later. Signatures are less urgent, a signature forged in 2040 cannot retroactively compromise a 2026 session, but certificate chains take years to migrate.
• Do not roll your own. Use your TLS library's PQ support rather than implementing lattice cryptography.

Algorithm Selection Guide

For encrypting data:

• Use AES-256-GCM, or ChaCha20-Poly1305 where AES hardware acceleration is unavailable. Both are AEAD modes, they authenticate as well as encrypt.
• To encrypt something larger than a few hundred bytes with a public key, use hybrid encryption: encrypt the data with AES and encrypt only the AES key asymmetrically.

For key exchange:

• Use ECDHE / X25519, ideally the hybrid post-quantum group X25519MLKEM768.
• Do not use RSA key transport. TLS 1.3 removed it because it provides no forward secrecy: one compromised private key exposes every recorded past session.

For digital signatures:

• Ed25519 for new designs; RSA-PSS (3072-bit or larger) where RSA is required for interoperability.
• Plan a migration path to ML-DSA.

For hashing and integrity:

• Use SHA-256 or SHA-3. Use HMAC, not a bare hash, whenever a secret key is involved.
• Avoid MD5 and SHA-1 for anything an adversary can influence.

For passwords:

• Use Argon2id, scrypt, or bcrypt. Never SHA-256, salted or otherwise, general-purpose hashes are far too fast for this job.

For legacy systems:

• DES and 3DES are disallowed and should only ever be decrypted, never used to encrypt new data.

What's Next?

Now that you understand encryption algorithms, explore related topics:

• String Algorithms - String processing techniques
• Machine Learning Algorithms - ML algorithms and techniques