Encryption transforms readable plaintext into ciphertext so that only someone with the correct key can recover the original data. It protects sensitive information at rest and in transit, but works best alongside access controls, audits, secure backups, and user education. section 8.4.1 section 8.4.2
Apply encryption to practical application boundaries:
- For data at rest, encrypt sensitive values before placing them in a database, then decrypt them only after retrieval. section 8.4.2
- For data in transit, serve REST applications over HTTPS and evaluate authentication, authorization, and endpoint protections. section 8.4.3
- Choose deliberately among symmetric and asymmetric encryption, block and stream ciphers, and established algorithms such as AES, RSA, and ECC. section 8.4.2
- Review generated implementations rather than treating them as production-ready: protect keys, test recovery, plan backups and rotation, and account for performance and latency. section 8.4.3
Encrypting a secret in Python
A practical AI-assisted starting point uses Python's cryptography library and Fernet: generate a key, create a cipher, encrypt byte-string plaintext, and decrypt the ciphertext with the same key. Adapt the example only after checking key storage, error handling, testing, and the requirements of the surrounding application.
