InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Complete guide to symmetric key cryptography covering block ciphers, stream ciphers, modes of operation, key management, and practical implementations with AES and ChaCha20.
Overview
Symmetric key cryptography uses the same key for both encryption and decryption. It is the workhorse of modern encryption — fast, efficient, and used for bulk data protection. The primary challenge is secure key distribution: both parties must possess the shared secret without it being intercepted.
Example
Symmetric Encryption Model:
==============================
Sender (Alice) Receiver (Bob)
| |
Plaintext |
| |
v |
[Encryption] ← Shared Key K → [Decryption]
| |
v v
Ciphertext ------[Channel]------> Plaintext
SAME key K used for both operations
Key must be shared securely beforehand
Block Ciphers vs Stream Ciphers
| Feature | Block Cipher | Stream Cipher |
|---|---|---|
| Unit of encryption | Fixed-size blocks (64/128 bits) | One bit/byte at a time |
| Speed | Fast for bulk data | Fast for real-time streaming |
| Padding required | Yes (unless using stream mode) | No |
| Error propagation | Depends on mode | Typically single bit |
| Examples | AES, DES, Blowfish | ChaCha20, RC4 (deprecated) |
| Common use | File encryption, disk encryption | VPN, wireless, TLS |
Modes of Operation
Block ciphers alone only encrypt fixed-size blocks. Modes of operation define how to encrypt messages longer than one block:
Cipher Modes Comparison
==========================
ECB (Electronic Codebook) - NEVER USE FOR REAL DATA
P1 → [Encrypt(K)] → C1
P2 → [Encrypt(K)] → C2 (identical blocks → identical ciphertext!)
P3 → [Encrypt(K)] → C3
Problem: Patterns in plaintext visible in ciphertext
CBC (Cipher Block Chaining)
IV → XOR with P1 → [Encrypt(K)] → C1
C1 → XOR with P2 → [Encrypt(K)] → C2
C2 → XOR with P3 → [Encrypt(K)] → C3
Each block depends on previous (no pattern leakage)
CTR (Counter Mode) - Turns block cipher into stream cipher
Nonce||Counter0 → [Encrypt(K)] → Keystream0 XOR P0 → C0
Nonce||Counter1 → [Encrypt(K)] → Keystream1 XOR P1 → C1
Parallelizable, random access, no padding needed
GCM (Galois/Counter Mode) - RECOMMENDED
CTR mode + Authentication tag (GMAC)
Provides: Confidentiality + Integrity + Authenticity
Used in TLS 1.3, IPSec, SSH
Python Implementation
Example
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import padding
import os
class SymmetricEncryption:
"""Demonstrate symmetric encryption with AES."""
def __init__(self, key_size: int = 256):
"""Generate a random AES key."""
self.key = os.urandom(key_size // 8) # 32 bytes for AES-256
self.key_size = key_size
def encrypt_aes_cbc(self, plaintext: bytes) -> dict:
"""Encrypt using AES-CBC mode."""
# Generate random IV (16 bytes for AES)
iv = os.urandom(16)
# Pad plaintext to block size
padder = padding.PKCS7(128).padder()
padded_data = padder.update(plaintext) + padder.finalize()
# Encrypt
cipher = Cipher(algorithms.AES(self.key), modes.CBC(iv))
encryptor = cipher.encryptor()
ciphertext = encryptor.update(padded_data) + encryptor.finalize()
return {"iv": iv, "ciphertext": ciphertext}
def decrypt_aes_cbc(self, iv: bytes, ciphertext: bytes) -> bytes:
"""Decrypt using AES-CBC mode."""
cipher = Cipher(algorithms.AES(self.key), modes.CBC(iv))
decryptor = cipher.decryptor()
padded_plaintext = decryptor.update(ciphertext) + decryptor.finalize()
# Remove padding
unpadder = padding.PKCS7(128).unpadder()
plaintext = unpadder.update(padded_plaintext) + unpadder.finalize()
return plaintext
def encrypt_aes_gcm(self, plaintext: bytes,
associated_data: bytes = None) -> dict:
"""Encrypt using AES-GCM (authenticated encryption)."""
nonce = os.urandom(12) # 96-bit nonce for GCM
cipher = Cipher(algorithms.AES(self.key), modes.GCM(nonce))
encryptor = cipher.encryptor()
if associated_data:
encryptor.authenticate_additional_data(associated_data)
ciphertext = encryptor.update(plaintext) + encryptor.finalize()
return {
"nonce": nonce,
"ciphertext": ciphertext,
"tag": encryptor.tag # Authentication tag
}
def decrypt_aes_gcm(self, nonce: bytes, ciphertext: bytes,
tag: bytes, associated_data: bytes = None) -> bytes:
"""Decrypt and verify AES-GCM."""
cipher = Cipher(algorithms.AES(self.key), modes.GCM(nonce, tag))
decryptor = cipher.decryptor()
if associated_data:
decryptor.authenticate_additional_data(associated_data)
plaintext = decryptor.update(ciphertext) + decryptor.finalize()
return plaintext
# Demonstration
crypto = SymmetricEncryption(key_size=256)
message = b"Confidential: Project budget is $2.5 million"
print(f"Original: {message.decode()}")
print(f"Key size: {crypto.key_size} bits")
# AES-GCM (recommended - provides authentication)
encrypted = crypto.encrypt_aes_gcm(
message,
associated_data=b"header: financial_report"
)
print(f"\nAES-GCM Encrypted: {encrypted['ciphertext'][:32].hex()}...")
print(f"Auth Tag: {encrypted['tag'].hex()}")
decrypted = crypto.decrypt_aes_gcm(
encrypted["nonce"],
encrypted["ciphertext"],
encrypted["tag"],
associated_data=b"header: financial_report"
)
print(f"Decrypted: {decrypted.decode()}")
Key Management Challenges
Key Lifecycle Management
===========================
Generation → Distribution → Storage → Use → Rotation → Destruction
| | | | | |
v v v v v v
CSPRNG Secure channel HSM Minimize Schedule Secure
adequate (DH, RSA, or or KMS exposure regular wiping
entropy physical) rotation
Key Distribution Problem
N users need pairwise keys = N(N-1)/2 keys total
10 users = 45 keys
100 users = 4,950 keys
1000 users = 499,500 keys
Solution: Key Distribution Center (KDC) or Public Key Infrastructure
Comparison of Symmetric Algorithms
| Algorithm | Key Size | Block Size | Status | Speed | Use Case |
|---|---|---|---|---|---|
| DES | 56 bits | 64 bits | BROKEN | Slow | None (legacy only) |
| 3DES | 168 bits | 64 bits | Deprecated | Very slow | Legacy banking |
| AES-128 | 128 bits | 128 bits | Secure | Fast | General purpose |
| AES-256 | 256 bits | 128 bits | Secure | Fast | High security, post-quantum |
| ChaCha20 | 256 bits | Stream | Secure | Very fast | Mobile, low-power devices |
| Blowfish | 32-448 | 64 bits | Aging | Fast | Legacy systems |
| Twofish | 128-256 | 128 bits | Secure | Fast | AES alternative |
Interview Questions
- Why is ECB mode insecure for encrypting images or structured data?
- ECB encrypts each block independently with the same key, so identical plaintext blocks produce identical ciphertext blocks. This preserves patterns — an encrypted image still shows the outline because similar pixel blocks encrypt the same way. CBC, CTR, and GCM modes solve this.
- What is the advantage of AES-GCM over AES-CBC?
- AES-GCM provides authenticated encryption — it ensures both confidentiality AND integrity/authenticity in a single operation. AES-CBC only provides confidentiality; you need a separate MAC for integrity. GCM is also parallelizable and doesn't require padding.
- How does the key distribution problem affect symmetric cryptography?
- Both parties need the same secret key, but exchanging it securely is difficult — you need a secure channel that doesn't yet exist. Solutions include physical exchange, Diffie-Hellman key agreement, or using asymmetric crypto to exchange symmetric keys (hybrid approach used in TLS).
- What is a nonce/IV and why must it never be reused with the same key?
- A nonce (number used once) or IV (initialization vector) ensures the same plaintext encrypts differently each time. Reusing a nonce with the same key in CTR/GCM modes allows XOR of two ciphertexts to cancel out the keystream, revealing XOR of two plaintexts — a catastrophic failure.
- Compare AES-256 and ChaCha20 for modern applications.
- AES-256 benefits from hardware acceleration (AES-NI instructions) making it fastest on x86/ARM with AES support. ChaCha20 is faster in software without hardware acceleration (mobile, IoT) and has simpler constant-time implementation, reducing side-channel risk.
Summary
Symmetric cryptography remains the primary method for bulk data encryption due to its speed and efficiency. Modern best practice uses AES-GCM or ChaCha20-Poly1305 for authenticated encryption, proper key management through KMS/HSM, and unique nonces for every encryption operation. The key distribution challenge is typically solved through hybrid schemes combining asymmetric and symmetric cryptography.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Symmetric Key Cryptography.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, cryptography, symmetric, key, symmetric key cryptography
Related Information Security Topics
Continue learning this concept
CryptographyAsymmetric Key CryptographyDeep dive into public key cryptography covering RSA, ECC, Diffie-Hellman key exchange, digital signatures, and how asymmetric algorithms solve the key distribution problem.CryptographyPublic Key Infrastructure (PKI)Understanding PKI components including Certificate Authorities, digital certificates, certificate lifecycle, revocation, and how PKI enables trust on the internet.CryptographyAES - Advanced Encryption StandardComplete guide to the AES algorithm covering its structure, rounds, key expansion, modes of operation, implementation in Python, and why AES replaced DES as the global encryption standard.CryptographyDES - Data Encryption StandardUnderstanding the Data Encryption Standard (DES), its Feistel structure, historical significance, vulnerabilities, evolution to 3DES, and why it was replaced by AES.CryptographyDigital SignaturesComplete guide to digital signatures covering RSA and ECDSA signing, verification process, certificate chains, applications in code signing and documents, with Python implementations.CryptographyEncryption vs DecryptionUnderstanding the fundamental processes of encryption and decryption, their differences, step-by-step operations, and practical applications in modern information security.