How Encryption Works: From Ancient Scytales to AES-256

A Spartan general wrapped a thin strip of leather around a wooden rod in 400 BCE, wrote his message lengthwise along the rod, and unwound the strip. The letters were now scrambled. Without a rod of the exact same diameter, the message was unreadable. That was encryption.

When your browser connects to your bank's website today, it performs a TLS 1.3 handshake using ECDHE key exchange, derives a shared secret through elliptic curve Diffie-Hellman, and encrypts all subsequent traffic with AES-256-GCM. The goal is identical to the Spartan scytale: prevent anyone without the key from reading the message. The mathematics is somewhat more involved.

You can try the ancient approach with our Scytale Cipher tool, or jump straight to modern symmetric encryption with the Block Cipher (AES/DES) tool.

Encryption is the process of transforming readable plaintext into unreadable ciphertext using a key. The transformation must be reversible: given the ciphertext and the key, you can recover the plaintext. Without the key, you cannot.

Claude Shannon defined two properties that any secure encryption system must have in his 1949 paper Communication Theory of Secrecy Systems. Confusion means the relationship between the key and the ciphertext is as complex as possible. Diffusion means changing one bit of plaintext changes many bits of ciphertext. In AES, confusion comes from the SubBytes step (a nonlinear substitution table) and diffusion comes from ShiftRows and MixColumns (which spread changes across the block).

Every encryption system has three components: the plaintext (input), the key (secret), and the ciphertext (output). The algorithm itself is public. This principle was formalized by Auguste Kerckhoffs in 1883 in his La Cryptographie Militaire: the security of a cipher must depend entirely on the key, not on the secrecy of the algorithm. Every modern encryption standard (AES, RSA, ChaCha20) is published openly. The only secret is the key.

Symmetric encryption uses the same key for encryption and decryption. The sender and receiver must agree on the key beforehand, and anyone who obtains the key can read or forge messages.

The Scytale used by Spartan generals (documented by Plutarch in Life of Lysander) is a transposition cipher. The key is the diameter of the rod. The plaintext is written along the rod, and when the strip is unwound, the letters are rearranged. Re-wrapping the strip around a rod of the same diameter restores the original message. You can experiment with this using our Scytale Cipher tool.

The Caesar cipher (documented by Suetonius, c. 121 CE) is a substitution cipher. The key is the shift value. Each letter is replaced by the letter N positions later in the alphabet. Our Caesar Cipher tool lets you encrypt and decrypt with any shift.

Modern symmetric encryption uses the same principle but with mathematical operations that provide far stronger confusion and diffusion. AES (Advanced Encryption Standard), specified in FIPS 197, processes data in 128-bit blocks through 10, 12, or 14 rounds depending on key size (128, 192, or 256 bits). Each round applies SubBytes (confusion), ShiftRows, MixColumns (diffusion), and AddRoundKey (mixing the key into the data). The key is expanded into a schedule of round keys, one per round.

AES-256 (14 rounds, 256-bit key) is the symmetric encryption standard used by the US government, TLS, Signal, and virtually every secure communication system in production today. Its key space is 2^256, which is approximately 1.15 x 10^77. Brute-forcing it at a billion keys per second would take roughly 3.6 x 10^60 years, which is vastly longer than the age of the universe.

In December 2024, NIST announced plans to standardize a wider variant of AES with 256-bit blocks (Rijndael-256) to address performance needs for processing large volumes of data where the 128-bit block size creates limitations. Public comments were due by June 2025.

Symmetric encryption has a fundamental problem: how do two parties who have never met agree on a shared key? If they send the key over an insecure channel, an eavesdropper intercepts it.

Asymmetric encryption solves this with two keys: a public key (shared openly) and a private key (kept secret). Data encrypted with the public key can only be decrypted with the private key. Data signed with the private key can be verified by anyone with the public key.

RSA, published by Rivest, Shamir, and Adleman in 1977, relies on the difficulty of factoring large composite numbers. A 2,048-bit RSA key is the current minimum recommended by NIST. The security comes from the fact that multiplying two large primes is easy, but factoring the product back into its primes is computationally infeasible with current technology.

Elliptic Curve Cryptography (ECC) achieves the same security with much smaller keys. A 256-bit ECC key provides security comparable to a 3,072-bit RSA key. This is why TLS 1.3 (specified in RFC 8446) prefers ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) for key exchange. The smaller keys mean faster handshakes and less bandwidth.

The key exchange process works like this: both parties perform Diffie-Hellman key agreement, which allows them to compute a shared secret without ever transmitting it. The shared secret is then used as the symmetric key for AES-GCM. This hybrid approach combines the key-distribution advantage of asymmetric cryptography with the speed of symmetric encryption. You can inspect RSA key parameters using our RSA Key Inspector tool.

Every HTTPS connection you make uses a combination of asymmetric and symmetric encryption. Here is what happens when your browser connects to a website:

1. The browser sends a ClientHello message listing supported cipher suites and TLS version. 2. The server responds with a ServerHello, selects a cipher suite, and sends its certificate (which contains its public key, signed by a certificate authority). 3. In TLS 1.3, the browser and server perform ECDHE key exchange. Both sides compute the same shared secret independently. 4. The shared secret is used to derive symmetric AES-256-GCM keys for encrypting traffic in both directions. 5. All subsequent communication is encrypted with the symmetric key. The asymmetric keys are used only for the handshake.

This is why HTTPS is fast. The asymmetric operations happen once, during the handshake. The bulk data transfer uses symmetric AES, which is hardware-accelerated on modern CPUs through AES-NI instructions.

TLS 1.3 (RFC 8446, published 2018) simplified this process significantly compared to TLS 1.2. It removed support for RSA key transport, static Diffie-Hellman, and weak algorithms like RC4 and 3DES. It supports only five cipher suites, all of which use authenticated encryption (AES-GCM or ChaCha20-Poly1305). You can look up specific cipher suites using our TLS Cipher Suite Lookup tool.

Web traffic (HTTPS): Every modern website uses TLS 1.3 with AES-256-GCM or ChaCha20-Poly1305. The OWASP Cryptographic Storage Cheat Sheet recommends AES-256-GCM for data at rest and TLS 1.3 for data in transit.

Messaging (Signal Protocol): Signal uses the Double Ratchet algorithm with Curve25519 for key agreement and AES-256-GCM for message encryption. Each message is encrypted with a unique key derived from a ratcheting chain, so compromising one key does not compromise past or future messages (forward secrecy).

Password storage: Passwords should never be encrypted (which implies they can be decrypted). They should be hashed with a slow, memory-hard function like Argon2 or PBKDF2. Our PBKDF2/Argon2 tool demonstrates this process.

File encryption: Tools like VeraCrypt and LUKS use AES-256 with XTS mode for full-disk encryption. XTS is a tweakable block cipher mode designed for storage media where each sector is encrypted independently.

Encryption is only as strong as its key management. The Equifax breach in 2017 exposed 147 million records not because AES was broken, but because an Apache Struts vulnerability allowed attackers to access the data before it was encrypted. The encryption was never the weak point.

Key reuse is another failure mode. Reusing a nonce in AES-GCM allows an attacker to XOR two ciphertexts and recover plaintext. Reusing a nonce in ECDSA allows full private key recovery, as Sony discovered in 2010 when hackers extracted the PS3 master signing key.

Quantum computing poses a long-term threat to asymmetric encryption. Shor's algorithm, if implemented on a sufficiently large quantum computer, could factor RSA keys and break ECC in polynomial time. NIST published the first post-quantum cryptography standards in August 2024 (FIPS 203 for ML-KEM, FIPS 204 for ML-DSA, FIPS 205 for SLH-DSA) and selected HQC for additional key establishment standardization in March 2025. Symmetric encryption like AES-256 is less affected: Grover's algorithm reduces its effective security to 128 bits, which remains adequate.