What Is Data Encryption?

Data encryption is the process of transforming readable information into an unintelligible form using a cryptographic algorithm and key, so that only parties holding the correct key can recover the original data. It is the primary technical mechanism for protecting the confidentiality of data in transit across networks and at rest on storage media. The field draws on number theory, algebra, and computational complexity, and its security depends on mathematical problems that are believed to be computationally intractable without knowledge of the key.

Encryption has been practiced in various forms for millennia, but modern data encryption is rooted in the work of Claude Shannon, who formalized the information-theoretic foundations of secrecy in 1949, and in the development of public-key cryptography by Diffie, Hellman, and Merkle in 1976. These developments transformed encryption from a specialized military tool into the infrastructure underlying secure communication for billions of users.

Symmetric Encryption

Symmetric encryption uses the same key for both encryption and decryption. The communicating parties must share this key through a separate secure channel before exchanging encrypted messages. The dominant symmetric cipher today is the Advanced Encryption Standard (AES), selected by NIST in 2001 through an open competitive process and specified as Federal Information Processing Standard 197. AES operates on 128-bit blocks of data and supports key lengths of 128, 192, and 256 bits; the cipher is based on the Rijndael algorithm designed by Joan Daemen and Vincent Rijmen. The NIST publication of the Advanced Encryption Standard, FIPS 197, defines the algorithm that now protects classified government information and the majority of commercial encrypted data worldwide. Symmetric encryption is substantially faster than asymmetric encryption, making it the method of choice for encrypting large volumes of data.

Asymmetric Encryption

Asymmetric encryption, also called public-key cryptography, uses mathematically related key pairs: a public key that anyone may use to encrypt a message, and a private key that only the recipient holds, used to decrypt it. The security of RSA, the most widely deployed asymmetric algorithm, rests on the computational difficulty of factoring the product of two large prime numbers. Elliptic curve cryptography (ECC) achieves equivalent security with much shorter keys by relying on the difficulty of the elliptic curve discrete logarithm problem; a 256-bit ECC key provides security comparable to a 3,072-bit RSA key. Asymmetric algorithms are computationally expensive for large data, so in practice they are used to establish a shared secret or authenticate identity, after which a symmetric cipher handles bulk encryption. The NIST Special Publication 800-175B Revision 1 guideline for using cryptographic standards recommends approved algorithm and key-length combinations for federal use, covering both symmetric and asymmetric schemes.

Key Management and Data Protection

The security of an encrypted system depends on the security of the keys as much as the strength of the algorithm. Key management encompasses the generation, storage, distribution, rotation, and destruction of cryptographic keys throughout their lifecycle. Hardware security modules (HSMs) are tamper-resistant physical devices that generate and store keys in a protected environment, preventing extraction even if the host system is compromised. Transport Layer Security (TLS), the protocol that protects HTTPS connections, combines asymmetric key exchange with symmetric bulk encryption and is defined in IETF RFC 8446. Full-disk encryption, file-level encryption, and database encryption extend data protection to stored data, ensuring that physical access to a device or storage medium does not yield readable content. NIST Special Publication 800-57 on key management recommendations covers key generation and lifecycle practices aligned with the approved security strengths of 112, 128, 192, and 256 bits.

Applications

Data encryption has applications in a wide range of disciplines, including:

• Secure web communications via TLS, protecting financial transactions and personal data exchanged over HTTPS
• Storage encryption on laptops, mobile devices, and cloud object stores to protect data in case of physical theft or unauthorized access
• Encrypted messaging systems that provide end-to-end confidentiality for personal and enterprise communications
• Payment card industry (PCI DSS) compliance, where encryption of cardholder data is a mandatory control
• Healthcare systems, where HIPAA regulations require encryption of electronic protected health information in transit and at rest