CryptoAESGCMChaCha20key distributionenvelope encryption

Symmetric Encryption

One shared key encrypts and decrypts — fast enough for bulk data, and the whole difficulty is getting that key to both parties and keeping it from everyone else.

▶ Run the labFollow the failure

Frame the problem

Security starts with a concrete asset, attacker capability and trust crossing.

Asset
Bulk data at rest and in transit, and the single key that protects all of it.
Attacker & capability
Anyone who obtains the key, or who can cause a nonce to repeat.
Trust boundary
Between key holders and everyone else.
Asset→Threat→Attack Surface→Trust Boundary→Vulnerability→Exploit Path→Impact→Mitigation→Defense in Depth→Residual Risk

Speed, and the key distribution problem

Symmetric ciphers are fast — hardware AES encrypts gigabytes per second — which is why every bulk encryption job (disks, database columns, TLS record layer, backups) uses them. The problem is that both parties need the same key, and sending it over the channel you are trying to protect is circular. TLS solves this with asymmetric key exchange to agree a symmetric session key (Asymmetric Cryptography). Storage solves it with a key hierarchy.

Envelope encryption: each object is encrypted with its own random data key; the data key is encrypted with a master key held in a key-management service and stored alongside the object. Rotating the master key re-wraps small data keys rather than re-encrypting terabytes; compromising one data key exposes one object; and the master key never leaves the KMS.

Envelope encryption
wrapstored alongsideKMS: master key (never exported)Random data keyData key encrypted with master keyObject encrypted with data key
UserLLMAgentToolDataDecisionHumanGuardrail

Modes and the nonce

Use AES-GCM or ChaCha20-Poly1305: authenticated, so tampering is detected. Never ECB (identical blocks encrypt identically — the penguin picture). Never CBC without a MAC. Each encryption under a key needs a fresh nonce; GCM with a repeated nonce is catastrophically broken. Libraries that generate the nonce and prepend it to the ciphertext are the right abstraction; raw primitives are not.

Key points

  • Symmetric is for bulk; the difficulty is key distribution.
  • Envelope encryption: per-object data keys wrapped by a KMS master key.
  • Authenticated modes only; nonces never repeat.
  • The key must live somewhere the data does not.

Boundary control exercise

This lesson uses the shared boundary-control exercise.

Boundary control check
Untrusted input / identity
→
Trust boundary
→
Privileged asset
Prevention may fail silently.

Follow the attack

Safe conceptual simulation: capability → missing control → crossed boundary → asset impact.

  1. 1
    Attacker → the key: config file, environment dump, memory, backup of the app server.
  2. 2
    Key → everything encrypted under it.
Blast radius
  • One key exposes everything it protects; without envelope encryption, that is all of it.

Defend, detect, recover

One prevention is a single point of security failure. Layer it and make failure observable.

Prevent
  • • KMS-held master keys; envelope encryption; authenticated modes; library-managed nonces.
Detect
  • • KMS audit logs: unusual decrypt volume or new callers.
Respond & recover
  • • Rotate the master key; re-wrap data keys; assume objects were readable during exposure.
Residual risk
  • • Data decrypted in application memory is plaintext to anyone with the application.
← Hashing vs Encryption vs EncodingAsymmetric Cryptography →