How encryption really works

Encryption protects your information every time you log in to your bank, shop online or send a message. Jens Bohlin, CEO of Tutus, explains the two fundamental types and how they work together in modern systems.

Encryption is the technology that today protects everything from banking and healthcare data to everyday communication and online shopping. But how does it actually work? There are two fundamental types of encryption, and in modern systems they are almost always used together.

The first and simplest form is called symmetric encryption. Here, the same key is used both to encrypt and to decrypt a message. The advantage is that these systems are fast and can handle large volumes of data at high speed. AES, the Advanced Encryption Standard, is a well-known example of a symmetric algorithm.

But symmetric systems have a fundamental challenge: key management. For communication to work, the sender and recipient must have access to exactly the same secret key, and that key must be protected from unauthorised parties. Jens Bohlin describes the problem.

– The key shared between sender and recipient has to be secret and must never end up in the wrong hands. The core problem is how to get that key to the person who needs it. You can’t use the encryption system itself to do it; it’s a chicken-and-egg problem, he says.

Historically, the result was often a manual and cumbersome process. This is also why an entirely different type of encryption was developed.

The public key and the private key

Asymmetric encryption solves the key problem by using two different keys: a public key and a private key. The public key can be shared freely with anyone, while the private key never leaves its owner. In modern systems, the private key is often stored on a smart card or a similar protected device.

The principle is simple: anyone who wants to send a secret message encrypts it with the recipient’s public key. Only the recipient, with their private key, can then decrypt it.

The system can also be run in reverse, which opens up further possibilities.

– An individual in the system can use their private key to perform a kind of encryption that anyone can then decrypt. The point is that it creates confidence that the message really was sent by the sender, since only the sender had the private key, says Jens.

This is precisely what underpins digital signatures, a way of verifying who actually sent something. The drawback of asymmetric systems is that they are considerably slower than symmetric ones.

The best of both worlds

The solution is to combine the two methods, and that is exactly what all modern systems do. Asymmetric systems are used to handle the key exchange: the parties identify themselves, establish trust and agree on a temporary session key. The fast symmetric encryption then takes over for the data transfer itself.

In other words, it is a symbiosis in which each method contributes its strengths: asymmetric encryption for secure key management and identification, symmetric encryption for fast and efficient data protection. Together, they form the backbone of the digital security we rely on every day.

– It happens several times a day for most of us, without us noticing. When you pay by card, log in to your bank, open your email or send a message. It’s this combination of symmetric and asymmetric encryption that makes it possible and keeps the information secure in transit, says Jens.