Encryption

Encryption turns readable data (plaintext) into unreadable data (ciphertext) using a key. Only someone with the right key can turn it back. Even if attackers steal the data, it's useless without the key.

1"card: 4111..."  --encrypt with key-->  "x9#Lq@2v..."
2"x9#Lq@2v..."    --decrypt with key-->  "card: 4111..."

Encryption vs Hashing vs Encoding

These three are often confused in interviews.

Base64 is not security. Anyone can decode it.

Symmetric vs Asymmetric Encryption

Symmetric: one key to encrypt and decrypt. Like a house key: the same key locks and unlocks.

Asymmetric: a key pair. The public key encrypts, only the private key decrypts. Like a mailbox: anyone can drop a letter in, only the owner can open it.

Real systems use both: asymmetric to safely share a key, then symmetric for the actual data. This is exactly what HTTPS does.

Encryption in Transit

Protects data while it moves between client and server, or between services.

TLS (HTTPS) in short:

11. Client connects, server sends its certificate (with public key)
22. Client verifies the certificate is trusted
33. Both sides agree on a shared session key (asymmetric step)
44. All further data is encrypted with that key (symmetric, fast)

• Use HTTPS for all client traffic.
• Use mTLS between internal services so both sides prove identity.

Encryption at Rest

Protects data while it's stored: databases, disks, backups, S3 files.

Disk encryption alone doesn't help if the app itself is hacked, because the app reads decrypted data. For very sensitive fields, use field-level encryption.

End-to-End Encryption (E2EE)

Data is encrypted on the sender's device and decrypted only on the receiver's device. The server can't read it, even though it stores and forwards it.

1Ravi's phone --encrypted--> Server (can't read) --encrypted--> Priya's phone

Used by WhatsApp and Signal. Trade-off: the server can't search, scan, or process the content.

Key Management (The Hard Part)

Encryption is only as safe as the key. If the key sits next to the data, encryption is pointless.

• Store keys in a KMS (AWS KMS, Google Cloud KMS) or HSM (dedicated hardware), never in code or config files.
• Rotate keys regularly.
• Give access to keys only to services that need them.

Envelope encryption (how cloud systems do it):

1Data Key (DEK)  → encrypts the actual data
2Master Key (KEK) → encrypts the data key, never leaves KMS
3 
4Store: encrypted data + encrypted DEK
5To read: ask KMS to decrypt DEK → use DEK to decrypt data

Why? Rotating the master key only means re-encrypting small data keys, not terabytes of data.

Passwords: Hash, Don't Encrypt

Passwords should never be decryptable, not even by you.

• Use slow hashing: bcrypt, scrypt, or Argon2.
• Add a unique salt per user, so two users with the same password get different hashes.
• Don't use fast hashes like MD5 or plain SHA-256 for passwords; attackers can try billions per second.

1Login: hash(entered password + salt) == stored hash ? ✔ : ✘

Summary

1Encryption = reversible with a key; hashing = one-way; encoding = not security
2→ symmetric (AES) is fast, asymmetric (RSA) solves key sharing; HTTPS uses both
3→ in transit: TLS / mTLS
4→ at rest: disk, database, field-level
5→ E2EE: even the server can't read
6→ keys live in KMS, use envelope encryption, rotate them
7→ passwords: bcrypt/Argon2 + salt, never encrypt

Next, we'll look at Idempotency, which makes sure retrying a request (like a payment) doesn't do the same thing twice.