🔒 Pro · Component 1 · 1.3.1 Compression, Encryption and Hashing
1.3.1b Encryption
OCR H446 · A Level Computer Science · ~13 min read
Notes
—
Video
—
Slides
—
Worksheet
—
Quiz
What is Encryption?
Encryption is the process of transforming readable data (plaintext) into an unreadable form (ciphertext) using an algorithm and a key, so that only authorised parties who hold the correct key can decrypt and read it.
Decryption is the reverse — converting ciphertext back to plaintext using a key.
Plaintext: the original, readable data before encryption.
Ciphertext: the encrypted, unreadable output.
Key: a piece of data used by the algorithm to encrypt or decrypt. Typically a large number (e.g. 256-bit).
Cipher: the encryption algorithm applied.
Why Encrypt?
Protect sensitive data in transit (e.g. banking transactions over the internet).
Protect data at rest (e.g. encrypted hard drives, encrypted database columns).
Ensure confidentiality — even if data is intercepted, it cannot be read without the key.
Meet legal/regulatory requirements (e.g. GDPR requires personal data to be protected).
Symmetric Encryption
In symmetric encryption, the same key is used for both encryption and decryption. Both the sender and receiver must hold the same secret key.
Advantages: fast; computationally efficient; suitable for large amounts of data.
Disadvantages: the key must be shared securely between parties before communication — the key distribution problem. If the key is intercepted during sharing, the encryption is compromised.
Examples: AES (Advanced Encryption Standard — the current standard, 128/192/256-bit keys), DES (Data Encryption Standard — now deprecated as insecure due to its short 56-bit key), 3DES.
AES is the modern symmetric standard. It uses substitution-permutation networks and operates on 128-bit blocks of data. AES-256 (256-bit key) is considered secure against brute-force attacks.
Asymmetric Encryption (Public Key Cryptography)
In asymmetric encryption, a mathematically linked pair of keys is used: a public key and a private key.
Public key: shared openly with everyone — used to encrypt messages.
Private key: kept secret by the owner — used to decrypt messages encrypted with the corresponding public key.
What is encrypted with the public key can ONLY be decrypted by the corresponding private key, and vice versa.
Solves the key distribution problem — you can publish your public key openly without security risk.
How Asymmetric Encryption Works
Alice wants to send a secret message to Bob:
Bob generates a key pair: a public key and a private key. He publishes his public key.
Alice encrypts her message using Bob's public key.
Alice sends the ciphertext to Bob.
Bob decrypts it using his private key.
Nobody else can decrypt it — not even Alice, because only Bob's private key decrypts messages encrypted with his public key.
Advantages: no need to share a secret key beforehand; solves the key distribution problem; used to establish secure connections.
Disadvantages: much slower and computationally more expensive than symmetric encryption; not suitable for large volumes of data.
HTTPS (used by secure websites) combines both approaches — using asymmetric encryption for the initial handshake to securely share a symmetric session key, then using the faster symmetric encryption for the actual data transfer.
Browser connects to server — server sends its public key (in a digital certificate).
Browser generates a random session key and encrypts it with the server's public key.
Server decrypts the session key using its private key.
Both browser and server now have the session key — all further communication is encrypted with symmetric AES.
Digital Signatures
Asymmetric encryption is also used for digital signatures — proving that a message came from a specific sender and has not been altered.
Sender encrypts a hash of the message with their private key → this is the digital signature.
Recipient decrypts the signature with the sender's public key → verifies the hash matches the message.
If the hash matches: the message is authentic (from that sender) and unmodified.
This provides: authentication (confirms sender identity) and integrity (confirms message not altered).
Symmetric vs Asymmetric Comparison
Feature
Symmetric
Asymmetric
Keys used
One shared secret key
Public key + private key pair
Speed
Fast
Much slower
Key distribution
Problem — key must be shared securely
Solved — public key shared openly
Use case
Bulk data encryption, disk encryption
Key exchange, digital signatures, HTTPS handshake
Examples
AES, DES, 3DES
RSA, ECC, Diffie–Hellman
Key Length and Security
Longer keys make brute-force attacks harder:
A 128-bit key has 2128 ≈ 3.4 × 1038 possible values — impossible to brute-force with current computers.
DES (56-bit key) can be brute-forced in hours with modern hardware — which is why it is deprecated.
AES-256 is the current gold standard for symmetric encryption.
RSA keys are much longer (typically 2048–4096 bits) because the mathematics of breaking RSA requires factoring very large numbers — a harder problem than brute-forcing a symmetric key.
Exam tip: Know both symmetric and asymmetric encryption — how they work, advantages/disadvantages of each, and when each is used. The HTTPS handshake combining both is a classic exam scenario. Be precise: in asymmetric encryption, you encrypt with the PUBLIC key and decrypt with the PRIVATE key.
Exam tip: Digital signatures work in reverse: signed with the PRIVATE key, verified with the PUBLIC key. Know the difference from message encryption.
⚠ Common Mistakes
Saying the private key is used to encrypt in asymmetric encryption — for normal message encryption: PUBLIC key encrypts, PRIVATE key decrypts. (For digital signatures it's the reverse, but that's separate.)
Saying HTTPS only uses asymmetric encryption — HTTPS uses BOTH. Asymmetric for the handshake (key exchange), then symmetric (AES) for the bulk data transfer because symmetric is much faster.
Confusing encryption with hashing — encryption is reversible (with the key); hashing is one-way (cannot be reversed). These are completely different concepts covered in the next lesson.
✓ Notes completed!
▶
Video coming soon
Click to advance · Arrow keys also work
Click slide or press arrow keys to navigate
✍
Worksheet — 1.3.1b Encryption
8 questions · 20 marks · instantly marked
Q1Define the terms 'plaintext', 'ciphertext', and 'key' as used in encryption.[3 marks]
✓ Mark scheme
Plaintext: the original, readable data before encryption [1]; ciphertext: the encrypted, unreadable output produced by applying an encryption algorithm and key to plaintext [1]; key: a piece of data (typically a large binary number) used by the encryption algorithm to transform plaintext into ciphertext (encryption) or ciphertext back into plaintext (decryption) [1].
Q2Explain what is meant by the 'key distribution problem' in symmetric encryption and describe how asymmetric encryption solves it.[4 marks]
✓ Mark scheme
Key distribution problem: in symmetric encryption, both parties must share the same secret key before they can communicate — but the key itself must be transmitted somehow; if the key is intercepted during transmission, the encryption is compromised because an attacker can now decrypt all messages [1]; there is no secure channel to share the key without already having encryption — a circular problem [1]; asymmetric encryption solves this: each party generates a public/private key pair and publishes their public key openly [1]; the sender encrypts using the recipient's public key — even if an attacker intercepts the ciphertext and knows the public key, they cannot decrypt it because only the recipient's private key (which is never transmitted) can decrypt it [1].
Q3Describe the steps involved in the HTTPS TLS handshake, showing how both asymmetric and symmetric encryption are used.[4 marks]
✓ Mark scheme
Step 1: the server sends its public key to the client (browser), typically inside a digital certificate signed by a Certificate Authority [1]; step 2: the client generates a random symmetric session key and encrypts it using the server's public key [1]; step 3: the server decrypts the session key using its private key — now both browser and server hold the same session key, without it ever being transmitted in plaintext [1]; step 4: all subsequent data (web page content, form data, etc.) is encrypted using the session key with a symmetric algorithm (e.g. AES) — symmetric is used because it is much faster than asymmetric for bulk data transfer [1].
Q4Explain how a digital signature works, using the terms 'private key', 'public key', and 'hash'. What does a digital signature prove?[4 marks]
✓ Mark scheme
The sender generates a hash of the message (a fixed-length digest) [1]; the hash is encrypted with the sender's private key — this encrypted hash is the digital signature [1]; the recipient receives the message + signature; they decrypt the signature using the sender's public key to recover the hash; they also independently hash the received message [1]; if both hashes match: the message is authentic (only the owner of the private key could have signed it) and has not been modified in transit (if altered, the hashes would differ) [1]; proves: authentication (message came from the claimed sender) and integrity (message was not altered).
Q5Compare AES and RSA, stating what type of encryption each is, their typical key lengths, and their relative speeds.[3 marks]
✓ Mark scheme
AES: symmetric encryption (same key encrypts and decrypts); typical key lengths: 128, 192, or 256 bits; fast — suitable for bulk data encryption [1]; RSA: asymmetric encryption (public/private key pair); typical key lengths: 2048–4096 bits (much longer because the security is based on the difficulty of factoring large numbers); much slower than AES — typically 100–1000× slower [1]; AES is used for data at rest and in transit (after the handshake); RSA is used for key exchange, digital signatures, and establishing secure connections [1].
Q6Why is DES (Data Encryption Standard) no longer considered secure? What replaced it?[2 marks]
✓ Mark scheme
DES uses a 56-bit key — this gives only 256 ≈ 72 quadrillion possible keys; with modern computing power this can be brute-forced in hours, making DES insecure for sensitive data [1]; DES was replaced by AES (Advanced Encryption Standard), which uses 128, 192, or 256-bit keys — making brute-force attacks computationally infeasible with current and foreseeable technology [1].
Q7Give TWO reasons why symmetric encryption is still used in HTTPS even though asymmetric encryption is considered more secure for key exchange.[2 marks]
✓ Mark scheme
Any 2 from: symmetric encryption is much faster than asymmetric — encrypting large amounts of web page data with RSA would be too slow for real-time web browsing [1]; symmetric encryption is computationally less intensive — it uses less CPU and battery power, important for mobile devices [1]; symmetric encryption can handle large data volumes efficiently — web pages, images, video streams — which asymmetric cannot match in performance [1].
Q8Describe ONE real-world application of encryption (other than HTTPS) and explain what type of encryption is used and why it is necessary.[2 marks]
✓ Mark scheme
Any valid application with justification, e.g.: Full-disk encryption (e.g. BitLocker, FileVault) — uses symmetric AES to encrypt the entire contents of a hard drive; if a laptop is lost or stolen, the data remains unreadable without the key [1]; necessary to prevent unauthorised access to personal or confidential data on physical devices [1]. Or: End-to-end encrypted messaging (e.g. WhatsApp, Signal) — uses asymmetric key exchange to share symmetric session keys; necessary so only the sender and recipient can read messages, not the messaging provider or third parties [1].
Topic Quiz
1 of 15
You scored
out of 15
🎯
Mini Test — 1.3.1b Encryption
10 questions · 10 marks · 10 minutes
5 MCQ + 5 short answer
⏱10:00
10 marks
Section A — Multiple Choice
Q1In asymmetric encryption, which key is used to ENCRYPT a message sent to the recipient?
Q2What is the main disadvantage of symmetric encryption compared to asymmetric?
Q3Which encryption standard replaced DES due to DES having too short a key?
Q4In the HTTPS TLS handshake, after the asymmetric exchange, what type of encryption is used for the actual data transfer?
Q5A digital signature proves:
Section B — Short Answer
Q6State the key distribution problem in symmetric encryption.
Mark schemeIn symmetric encryption, both parties must share the same secret key before they can communicate securely. The key itself must be transmitted, and if it is intercepted during this transmission, an attacker can decrypt all messages. [1 mark]
Q7In asymmetric encryption, what is the private key used for?
Mark schemeThe private key is used to decrypt messages that were encrypted with the corresponding public key. It is kept secret by the owner and never shared. It is also used to create digital signatures (signing a hash of a message). [1 mark]
Q8Why is AES-256 considered more secure than DES?
Mark schemeAES-256 uses a 256-bit key, giving 2^256 possible keys — practically impossible to brute-force with current technology. DES uses only a 56-bit key (2^56 ≈ 72 quadrillion possibilities), which modern computers can brute-force in hours. [1 mark]
Q9Why does HTTPS use symmetric encryption (AES) for data transfer rather than only asymmetric encryption?
Mark schemeSymmetric encryption is much faster and computationally less intensive than asymmetric encryption. Encrypting large volumes of web data with asymmetric encryption (RSA) would be too slow for real-time browsing. AES handles bulk data efficiently. [1 mark]
Q10State one advantage of asymmetric encryption over symmetric encryption.
Mark schemeNo need to securely share a secret key beforehand — the public key can be shared openly without security risk; only the private key (which is never transmitted) can decrypt messages encrypted with the public key. This solves the key distribution problem. [1 mark]