Encryption
How SSL/TLS, VPNs, and End-to-End Encryption Protect Your Data
You see the padlock icon in your browser. You hear "end-to-end encryption" in WhatsApp ads. You turn on a VPN to "protect your privacy." But what is encryption actually doing? How does it work without slowing everything down? Encryption is the single most important technology for privacy in the digital age.
1. What Is Encryption?
Encryption is the process of converting readable data (plaintext) into an unreadable format (ciphertext) using a mathematical algorithm and a secret key. Only someone with the correct key can decrypt it back to plaintext.
Modern encryption algorithms (AES, ChaCha20) are extremely strong. Without the key, the fastest supercomputer would take billions of years to break them.
2. Two Types of Encryption – Symmetric vs. Asymmetric
Symmetric encryption: The same key encrypts and decrypts. Fast and efficient. Used for bulk data (hard drive encryption, file encryption). Problem: how do you securely share the key with the other party?
Asymmetric encryption: Uses two mathematically linked keys: a public key (share with everyone) and a private key (keep secret). Data encrypted with the public key can only be decrypted with the private key.
|
Feature |
Symmetric (AES) |
Asymmetric (RSA, ECC) |
|
Keys |
One secret key |
Two keys (public + private) |
|
Speed |
Very fast |
Slow (100–1000× slower) |
|
Use case |
Encrypting files, disk, data |
Key exchange, digital signatures, SSL/TLS handshake |
Real-world: TLS (HTTPS) uses asymmetric encryption to securely exchange a symmetric session key. Then the actual web traffic is encrypted with symmetric encryption for speed.
3. TLS/SSL – The Padlock in Your Browser
When you visit an https:// website, your browser and the server perform a TLS handshake:
- Your browser sends a list of supported encryption algorithms.
- The server sends its digital certificate (contains its public key, signed by a Certificate Authority).
- Your browser checks that the certificate is trusted.
- Your browser generates a random symmetric key, encrypts it with the server's public key, and sends it.
- Both sides now have the same symmetric key. All subsequent data is encrypted with fast AES.
What TLS protects against: Eavesdropping and tampering. What TLS does NOT protect against: The website itself being malicious (the padlock does not mean the site is trustworthy – only that the connection is encrypted).
4. VPN – Virtual Private Network, Explained Honestly
A VPN creates an encrypted tunnel between your device and a VPN server. All your internet traffic goes through that tunnel.
What a VPN actually does:
- Hides your IP address from the website (the website sees the VPN server's IP).
- Encrypts traffic from your device to the VPN server (protects against Wi-Fi eavesdropping).
- Bypasses geographic restrictions.
What a VPN does NOT do:
- Make you anonymous. The VPN provider can see your real IP and all your traffic.
- Protect against malware or phishing.
- Encrypt data from the VPN server to the website – use HTTPS for that.
Choosing a VPN: Avoid "free" VPNs – they often sell your data. Trusted paid options: Mullvad, ProtonVPN, IVPN. For most users, a VPN is unnecessary for daily home browsing if you already use HTTPS.
5. End-to-End Encryption (E2EE)
With normal HTTPS, your message is encrypted between you and the service provider, but the provider can read your message on their servers. End-to-end encryption means the message is encrypted on your device and only decrypted on the recipient's device. The service provider never has the decryption key.
- Signal: Gold standard for E2EE messaging (open source, no metadata).
- WhatsApp: E2EE by default (but metadata collected by Meta).
- iMessage: E2EE between Apple devices, but backups may not be.
- Telegram: Only "Secret Chats" are E2EE; normal chats are not.
6. Encryption at Rest vs. Encryption in Transit
|
Encryption at Rest |
Encryption in Transit |
|
|
What it protects |
Data stored on disk (hard drive, SSD, USB) |
Data moving over a network |
|
Examples |
BitLocker (Windows), FileVault (Mac), LUKS (Linux) |
HTTPS, VPN, SSH, TLS |
|
Threat model |
Theft of device, unauthorized physical access |
Eavesdropping, man-in-the-middle attacks |
You need both. Encrypting your laptop's hard drive does nothing if you send a password over unencrypted HTTP. Conversely, HTTPS does nothing if someone steals your laptop and reads the unencrypted drive.
Summary
|
Term |
Definition |
|
Symmetric encryption |
Same key for encrypt and decrypt (fast). |
|
Asymmetric encryption |
Public key (encrypt/verify) and private key (decrypt/sign). |
|
TLS/SSL |
Protocol that encrypts web traffic (HTTPS). |
|
VPN |
Encrypted tunnel to a remote server; hides IP from websites. |
|
End-to-end encryption |
Only sender and recipient can decrypt; provider cannot. |
|
Encryption at rest |
Protects data on storage devices. |
|
Encryption in transit |
Protects data traveling over networks. |
Review Questions
- Why does HTTPS use both asymmetric and symmetric encryption instead of just symmetric?
- If you use a VPN, do you still need HTTPS? Why?
- Your messaging app claims "military-grade encryption." But is it end-to-end encrypted? How can you verify?