Encryption

Rédigé par David Brulin, co-fondateur de Quai des Balises

Encryption is the process of transforming readable data (plaintext) into an unreadable form (ciphertext) using a cryptographic algorithm and a key. Only parties holding the correct key can reverse the process and recover the original data, protecting confidentiality even if the data is intercepted or stolen.

Symmetric vs asymmetric encryption

Encryption schemes fall into two main families, distinguished by how keys are managed. Symmetric encryption uses a single shared secret key for both encrypting and decrypting, making it fast and well suited to bulk data. Asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt, solving the problem of exchanging secrets over an untrusted channel.

Symmetric: one key, high performance, ideal for encrypting large volumes (databases, files, disk). The challenge is securely distributing the shared key.
Asymmetric: a public/private key pair, slower, used for secure key exchange, digital signatures, and identity verification.

In practice, real systems combine both: asymmetric encryption negotiates a session, then a fast symmetric key protects the actual data. This hybrid model underpins protocols like TLS.

Criterion	Symmetric encryption	Asymmetric encryption
Keys	One shared secret key	Public key + private key pair
Speed	Fast	Slower (heavier computation)
Typical use	Bulk data, files, disks, databases	Key exchange, digital signatures
Common algorithms	AES, ChaCha20	RSA, ECC (elliptic curve)
Main challenge	Secure key distribution	Performance, key management

Encryption at rest vs in transit

Beyond the algorithm, encryption is applied at two distinct points in a data lifecycle. Protecting both is a baseline expectation for any business application handling sensitive or regulated data.

Encryption in transit: data is protected while moving across networks, for example between a browser and a server or between microservices. This is typically handled by TLS (the protocol behind HTTPS), preventing interception and tampering.
Encryption at rest: data is protected while stored, on disks, in databases, in backups, or in object storage. It defends against threats such as stolen drives, leaked backups, or unauthorized access to storage infrastructure.

A common architectural mistake is securing only one layer. Data encrypted in transit but stored as plaintext remains exposed if the storage is breached; data encrypted at rest but transmitted unprotected can be captured on the network. Robust systems enforce both, alongside disciplined key management, ideally backed by a dedicated key management service.

Questions fréquentes

Encryption is reversible: with the correct key, ciphertext can be decrypted back into the original plaintext. Hashing is a one-way transformation designed not to be reversed, producing a fixed-length fingerprint of the input. Encryption protects confidentiality of data you need to read again, while hashing is typically used to store passwords or verify data integrity.

No. Encryption protects data confidentiality, but it does not address access control, authentication, input validation, or secure key storage. A poorly managed key, a leaked credential, or a vulnerable endpoint can undermine even strong encryption. Encryption is one essential layer within a broader security strategy, not a complete solution on its own.

HTTPS is HTTP secured by the TLS protocol, which encrypts the connection between a client and a server. It uses asymmetric encryption to establish trust and exchange a session key, then symmetric encryption to protect the actual traffic. This is a concrete, everyday example of encryption in transit.

End-to-end encryption means data is encrypted on the sender's device and only decrypted on the recipient's device, so no intermediary, including the service provider or server passing the data along, can read it. It is stronger than encrypting only in transit, because the data stays protected throughout its entire path, not just on the network segment.

Building a custom software project? We design bespoke software aligned with your roadmap.

See our custom software expertise

Définitions liées

← Retour au glossaire