Symmetric encryption

Why one password both locks and opens a 7-Zip archive

Symmetric encryption scrambles data with a secret key, and only the same key unscrambles it. Lock a 7-Zip archive with a password and 7-Zip turns it into a 256-bit AES key; your friend's copy of the password undoes it.

Unlike a hash from lesson 1, this scrambling is meant to be undone, but only with the key. The scrambled output is called ciphertext and the readable input is called plaintext. Without the key, the ciphertext should look like random bytes.

Symmetric encryption

Your home Wi-Fi scrambles every packet with AES

On WPA2 or WPA3 Wi-Fi, your phone and the router hold the same secret key and encrypt every packet with AES. A neighbour can capture the radio signal, but without the key it is only noise.

The same idea protects a stolen laptop: BitLocker on Windows and FileVault on macOS encrypt the whole disk with AES. The key is unlocked only when you sign in, so pulling the drive out and reading it elsewhere shows nothing useful.

Symmetric encryption

AES scrambles each 16-byte chunk in rounds only the key can undo

AES cuts data into 16-byte blocks and runs each through 10 rounds (14 for a 256-bit key). Each round swaps bytes via a lookup table, shuffles rows, blends columns, then XORs in a round key made from your key.

Every step is reversible, so decryption runs the inverses in reverse order with the same round keys. After the rounds, one flipped input bit changes about half the output, so the only attack left is guessing among 2¹²⁸ keys.

Modes like GCM mix a fresh counter into each block, so repeated plaintext never repeats in the ciphertext. Built-in CPU instructions make AES fast enough for every disk write. The catch: both sides must already share the key.