Encryption

Modern encryption follows Kerckhoffs's principle: the algorithm is public and security rests on the key alone. The workhorse symmetric cipher is AES (FIPS 197, 2001), a block cipher with a 128-bit block and 128-, 192- or 256-bit keys; ChaCha20 is the common stream-cipher alternative on hardware without AES instructions. A block cipher on its own encrypts only one block, so a mode of operation matters as much as the cipher: ECB leaks patterns because identical blocks give identical ciphertext, and CBC without a separate MAC is malleable and has repeatedly fallen to padding-oracle attacks. Current practice is authenticated encryption with associated data (AEAD), such as AES-GCM (NIST SP 800-38D) or ChaCha20-Poly1305 (RFC 8439), which provides confidentiality and integrity together. GCM's weak spot is nonce reuse: encrypting two messages with the same key and nonce exposes the XOR of the plaintexts and lets an attacker forge authentication tags.

Asymmetric schemes (RSA, elliptic-curve cryptography) are slow and are used to establish or wrap symmetric keys rather than to encrypt bulk data. RSA encryption needs proper padding (OAEP); the older PKCS#1 v1.5 padding enabled Bleichenbacher's 1998 oracle attack, which resurfaced as ROBOT in 2017. TLS 1.3 therefore uses ephemeral (EC)DH key agreement for forward secrecy, and cloud KMS services use envelope encryption: data is encrypted with a data-encryption key (DEK), which is itself encrypted by a key-encryption key (KEK) held in the KMS or an HSM. NIST SP 800-57 Part 1 maps key sizes to security strength: RSA-2048 gives roughly 112 bits, RSA-3072 and the P-256 curve roughly 128 bits.

A large enough quantum computer running Shor's algorithm would break RSA and elliptic-curve schemes, while Grover's algorithm only halves the effective strength of symmetric keys, which is why AES-256 is favoured for long-lived data. NIST published its first post-quantum standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Because traffic recorded today can be decrypted later ("harvest now, decrypt later"), major browsers and TLS libraries have already deployed hybrid key exchange that combines X25519 with ML-KEM.

Encryption is frequently overestimated. Full-disk encryption such as BitLocker protects a powered-off or locked device; once the system is unlocked, the operating system decrypts transparently for every process, including ransomware. Database transparent data encryption protects files and backups, not data fetched through SQL injection. Unauthenticated encryption does not guarantee integrity, and encryption is not hashing. In practice most failures are about keys and randomness - hard-coded keys, weak random number generators, keys stored beside the data - rather than broken algorithms. Legally, GDPR Art. 32(1)(a) names encryption as an example of an appropriate measure, Art. 34(3)(a) can remove the duty to notify data subjects when breached data was unintelligible to unauthorised persons, and NIS2 Art. 21(2)(h) requires policies on cryptography and encryption.