Encryption Goals and Key Models

Plaintext is the information supplied to encryption, and ciphertext is the encrypted representation. The encryption algorithm uses a key to transform the information; a suitable decryption procedure with the required key recovers it. Public knowledge of an algorithm is compatible with security when the system’s assumptions and secret-key requirements are satisfied. Encoding text as hexadecimal is not encryption.

Confidentiality concerns preventing unauthorised disclosure. Encryption does not automatically establish every other property: a system may also need integrity, origin authentication, access control and protection of decrypted endpoint data. Explain the threat and the boundary. An encrypted file left open on an unlocked account can still be read through that account.

In a symmetric model, communicating parties use a shared secret, with the required keying material available to both encryption/decryption participants. This can support efficient protection of substantial data, but securely distributing and retaining the secret matters. Sending the key alongside ciphertext through the same exposed channel does not protect it from the same observer.

Asymmetric encryption uses a public/private pair: a sender can encrypt appropriately for a recipient using the recipient’s public key, while the recipient retains the private decryption capability. Public does not mean unauthenticated keys are safe to accept from anyone. An attacker could substitute their own public key unless the sender verifies its binding to the intended recipient through a suitable trust mechanism.

A hybrid design can use an appropriate asymmetric or agreement mechanism to establish keying material, then symmetric authenticated encryption for bulk traffic. Do not assume every protocol uses RSA key transport; the companion TLS lesson identifies its version-specific agreement model. Authentication and key establishment must fit the actual protocol rather than a generic diagram that silently changes halfway through.

Compare shared-secret management, computational cost, compromise consequences and the number of communicating parties. Losing a decryption key may prevent legitimate recovery, while exposing it may disclose information within the relevant scheme’s limits. A signature is not simply a universal claim that “private-key encryption provides confidentiality”: signature schemes have a different purpose and verification structure. Use exact terms for what is encrypted, what is signed and what identity is checked.

Attempt the task before opening its worked response. Record each change of state, explain the rule used, and check the result against the original requirements. Code examples labelled Python 3 use that language’s conventions; pseudocode states its own assumptions.