Encryption, simply explained.
Encryption is the mathematics that keeps your UPI payments, WhatsApp chats and passwords safe. You don't need maths to understand it. You need a locked box and two kinds of keys.
Encryption = scrambling with a key
Encryption turns readable data (plaintext) into scrambled data (ciphertext) using a key. Only someone with the right key can turn it back. Without the key, it looks like random noise.
Type 1: Symmetric, one key for both
Imagine a box with a lock, and you and your friend each have a copy of the same key. You lock, they unlock. Fast and simple. The most common algorithm is AES, used to encrypt hard disks, Wi-Fi and most data.
The problem: how do you get the key to your friend safely? If you send it over the internet, someone might copy it.
Type 2: Asymmetric, a public and a private key
Now imagine a special post box with a slot. Anyone can drop a letter in through the slot (that's your public key, which you can share with the whole world). Only you have the key that opens the box (your private key, which you never share).
- People encrypt messages with your public key.
- Only your private key can decrypt them.
Common algorithms: RSA and elliptic-curve (ECC). It's slower than AES, so in practice we use asymmetric encryption to safely share a symmetric key, then use the fast symmetric key for the rest. HTTPS does exactly this.
Which should NEVER be shared with anyone?
The private key is your secret. The public key is meant to be shared; a hash reveals nothing useful.
Hashing is not encryption
People mix these up in interviews. Encryption is two-way: with the key you get the data back. Hashing is one-way: you can never get the original back (Lesson 8). Hashes are also used to check integrity: if even one letter of a file changes, its hash changes completely.
Digital signatures: proving who sent it
Asymmetric keys also work in reverse. If you "sign" something with your private key, anyone can check it with your public key, proving it really came from you and wasn't changed. That's how your phone knows an Android update really came from Google, and not from an attacker.
HTTPS and certificates
When you open https://www.icicibank.com:
- The website shows a certificate: a digital ID card saying "I am icicibank.com", signed by a trusted Certificate Authority.
- Your browser checks the signature against authorities it already trusts.
- Your browser and the server use asymmetric encryption to agree on a fresh symmetric key.
- Everything after that is encrypted with that fast symmetric key.
A certificate proves the site is really that domain, not that the domain is honest. A scammer can get a valid certificate for icici-rewards-claim.in. Always read the domain.
End-to-end encryption
WhatsApp and Signal use end-to-end encryption: messages are encrypted on your phone and only decrypted on your friend's phone. Even the company in the middle can't read them. But end-to-end encryption doesn't protect you if someone has your unlocked phone or tricks you into sharing a code.
Your browser shows a certificate warning on your college login page. What's the safest action?
A certificate warning can mean someone is intercepting the connection. Never type passwords past a certificate warning.
Your task (10 min)
Open any website in Chrome, tap the icon left of the address (the "site information" icon), then Connection is secure → Certificate is valid. Look at who the certificate was issued to and by, and its expiry date. Try it on google.com and on your bank's site. You just inspected a real certificate like a security analyst.
Lesson 10 complete!
You understand symmetric and asymmetric encryption, hashing vs encryption, digital signatures and HTTPS certificates. Next: logs, SIEM and the SOC, where most security jobs live.
Next: Logs, SIEM and the SOC →