[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.3.b
AP Cybersecurity · Securing Applications and Data
Applying Symmetric Encryption
One key, both directions — which makes key handling the whole problem.
key ideaOne key, both directions. Whoever can decrypt can also encrypt — which is what makes key handling the whole problem.
The syntax
Computer-based encryption algorithms operate on binary data. The most common symmetric algorithm is the Advanced Encryption Standard — AES — used to secure Wi-Fi, stored files and traffic in transit. It is a symmetric key block cipher.
| Property | AES |
|---|
| type | symmetric — the same key encrypts and decrypts |
| mode | block cipher |
| block size | 128 bits — 16 bytes |
| key length | varying — longer keys are more secure but require more time and processing |
| where it appears | Wi-Fi security, encrypted files, encrypted traffic |
The key-length row is the design decision. Longer keys produce more secure encryption but require more time and processing power — so the choice is a trade, not a maximum.
encrypting a file with OpenSSLthe key is derived from the password provided
$ openssl enc -aes-256-cbc -in test.txt -out test.enc
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
encthe OpenSSL encryption subcommand-aes-256-cbcthe algorithm, key length and mode — AES with a 256-bit key-in test.txtthe plaintext file-out test.encwhere the ciphertext is writtenpassword promptthe encryption key is derived from the password provided — a weak password means a weak key
Doing it step by step
1
Choose the algorithm and key length
AES for symmetric work. Longer keys are more secure and cost more time and processing — follow the organization's cryptography policy rather than deciding per file.
in a file out a chosen cipher
2
Encrypt, supplying the password
On a command line, OpenSSL derives the key from the password you provide. Specialized software and web-based tools do the same thing behind a different interface.
out a ciphertext file
3
Handle the key deliberately
Symmetric means the same key decrypts. Anyone who receives it can read everything it protects — so how it reaches the other party is part of the design, not an afterthought.
out a key-distribution decision
4
Decrypt with the same algorithm and key
Add -d to decrypt. A different algorithm, mode or password will simply fail.
out the plaintext again
5
Verify the round trip
Compare the decrypted output with the original before deleting anything. An encryption you have never successfully reversed is a backup you do not have.
out confidence the process worked
128-bit blocks, variable key length. The last one is where the security decision lives.decrypting it againthe same algorithm, plus -d
$ openssl enc -d -aes-256-cbc -in test.enc -out test_decrypted.txt
enter aes-256-cbc decryption password:
-dthe decrypt flag — everything else matches the encryption command-aes-256-cbcmust match exactly; a different mode or key length failspasswordthe same password, so the same key is derived-outwhere the recovered plaintext is written
Worked analysis
EX 1
Read the command
Explain each part of openssl enc -aes-256-cbc -in test.txt -out test.enc.
1
The tool and subcommand
openssl enc — the encryption subcommand of OpenSSL.
2
The cipher specification
-aes-256-cbc — AES, a 256-bit key, in CBC mode.
3
The input
-in test.txt — the plaintext.
4
The output
-out test.enc — where the ciphertext goes.
5
The missing argument
The key is not on the command line — it is derived from the password entered at the prompt.
EX 2
Choose a key length
AES supports several key lengths. What is gained and lost by choosing a longer one?
1
State the gain
Longer keys produce more secure encryption — a larger keyspace to search.
2
State the cost
They require more time and processing power to encrypt and decrypt.
3
Note where the cost bites
High-volume traffic and constrained devices, not one-off file encryption.
4
Give the practical rule
Follow the cryptography policy's minimum, and choose longer where the data warrants it.
5
Note what does not change
The block size stays at 128 bits regardless of key length — the two are separate parameters.
EX 3
The symmetric problem
Two colleagues want to exchange an encrypted file using AES. What is the difficulty?
1
State what AES needs
Both parties must hold the same key.
2
Name the problem
Getting the key to the other person without it being intercepted.
3
Reject the obvious approach
Emailing the password beside the file protects nothing — both travel the same path.
4
Give the practical answers
A separate channel agreed in advance, or asymmetric encryption used to exchange the symmetric key.
5
State the general point
Symmetric encryption is efficient and leaves key distribution unsolved — which is exactly the gap asymmetric algorithms fill.
Verify the result
four checks
- Decrypt the file and compare with the original before relying on the ciphertext.
- The decryption command must match the encryption command in algorithm, key length and mode.
- Remember the key is derived from the password — a weak password produces a weak key regardless of the cipher.
- Decide how the key reaches the other party before you need it to.
Check yourself
What kind of cipher is AES, and what is its block size?
Show answer
A symmetric key block cipher that encrypts data in 128-bit blocks — 16 bytes.
What does AES secure, according to the CED?
Show answer
Wi-Fi, stored files, and traffic in transit — it is the most common symmetric encryption algorithm.
What is the trade-off in AES key length?
Show answer
Longer keys produce more secure encryption but require more time and processing power to encrypt and decrypt.
In the OpenSSL command, where does the key come from?
Show answer
It is derived from the password provided at the prompt — it is not typed on the command line.