Symmetric encryption

Symmetric ciphers come in two forms. Block ciphers such as AES (Rijndael, standardised in FIPS 197 in 2001) transform fixed 128-bit blocks under a 128-, 192- or 256-bit key in 10, 12 or 14 rounds; stream ciphers such as ChaCha20 generate a keystream that is XORed with the plaintext. A block cipher alone is only a keyed permutation. What is actually used is a mode of operation (NIST SP 800-38 series), and the mode determines most of the security. ECB encrypts identical blocks to identical ciphertext and leaks structure; CBC needs an unpredictable IV and, without integrity protection, is exposed to padding-oracle attacks (Vaudenay 2002, later POODLE and Lucky Thirteen in TLS); CTR turns the block cipher into a stream cipher.

Modern practice is authenticated encryption with associated data (AEAD), which provides confidentiality and integrity in one primitive: AES-GCM (SP 800-38D), ChaCha20-Poly1305 (RFC 8439) and AES-CCM. TLS 1.3 permits only AEAD suites. AEAD shifts the critical requirement to the nonce: with GCM, reusing a 96-bit nonce under the same key reveals the XOR of the plaintexts and lets an attacker recover the authentication key and forge messages. SP 800-38D therefore limits random-nonce GCM to 2^32 invocations per key, and nonce-misuse-resistant modes such as AES-GCM-SIV (RFC 8452) exist for cases where uniqueness cannot be guaranteed. Encrypt-then-MAC is the safe generic composition when a separate MAC must be used.

Disk encryption is a special case, because there is no room for a nonce or tag in a 512- or 4096-byte sector: XTS-AES (SP 800-38E, IEEE 1619), used by BitLocker, FileVault and LUKS, gives confidentiality per sector but no authentication, so an attacker with write access can corrupt data undetected. Block size also matters: 64-bit block ciphers such as 3DES and Blowfish are vulnerable to birthday-bound attacks after around 32 GB under one key (Sweet32, 2016), and NIST SP 800-131A Rev. 2 disallowed 3DES encryption after 2023. DES's 56-bit key was brute-forced by the EFF's dedicated machine in 1998.

Key length versus quantum computers is often overstated: Grover's algorithm gives at most a quadratic speed-up, so AES-128 is reduced to roughly 64-bit security in an idealised model that ignores the enormous cost of running it, and AES-256 is the conservative choice for long-lived data. The real weaknesses of symmetric encryption are almost never the cipher itself but key distribution, nonce management, missing authentication and side channels in software implementations, which is why hardware instructions such as AES-NI and constant-time libraries matter. Symmetric encryption differs from hashing (no key, not reversible) and from public-key cryptography, which is typically used only to establish the symmetric key that then protects the data.