Symmetric-key encryption protects confidentiality by using one shared secret key for both encryption and decryption. An eavesdropper sees ciphertext intended to resemble random bytes, while the algorithm itself must remain secure even when publicly known. section 1.2.1 section 8.1
Figure 1.2 Using symmetric keys for encryption and decryption
Trace the same secret key through encryption and decryption. section 1.2.1
Stream ciphers and block ciphers are the two major categories. Both reduce the secret-key material required by a one-time pad: an OTP can be theoretically unbreakable, but its random key must be as long as the plaintext and never reused. section 8.1 section 8.1
Engineering constraints shape how the primitive is deployed:
- Keep the shared key private between intended participants; securely exchanging that key over an insecure channel remains the central unresolved problem. section 8.1
- Prefer publicly auditable algorithms and implementations rather than relying on hidden designs or source code for security. section 1.2.1
- Use symmetric keys for performance, while recognizing that asymmetric cryptography can address key distribution and can wrap symmetric keys. section 8.5 section 8.1
A shared secret protecting an API request
A message authentication code uses a secret key shared by sender and receiver. The receiver recalculates the MAC, while an attacker who lacks the key cannot forge a valid value for modified data. Password-reset links can carry an account name, expiry timestamp, and MAC. section 7.1 section 7.1
