Learn / Encryption
Encryption · 2 min read
The different kinds of encryption, and how strong each is
Symmetric, public-key, hashing and the protocols that put them together, compared side by side.
People say "encryption" as if it were one thing. In practice a private chat uses several tools together, each good at a different job. Here is the lineup.
| Kind | Examples | Used for | Strength today |
|---|---|---|---|
| Symmetric | AES-256, ChaCha20-Poly1305 | Locking the actual data: messages, files, disks. One shared key does both locking and unlocking. | Very strong. A 256-bit key has about 10^77 possibilities, and no known practical attack beats guessing them all. |
| Public-key (asymmetric) | RSA-2048 and up, Curve25519, Ed25519, P-256 | Agreeing on keys with a stranger safely, and proving who sent something (signatures). | Strong today. RSA-2048 offers roughly 112 bits of security and Curve25519 roughly 128. Both could be broken by a large future quantum computer. |
| Hashing | SHA-256, SHA-3, Argon2, bcrypt | One-way fingerprints, and storing passwords without keeping the passwords. | SHA-256 is sound. MD5 and SHA-1 are broken for security use. Password hashes should be deliberately slow (Argon2, bcrypt). |
| Transport | TLS 1.3 (the padlock in your browser) | Protecting data on the road between your device and a server. | Strong. It protects the trip, not what the server does with your data afterward. |
| Messaging protocols | Signal protocol (Double Ratchet), Matrix Olm and Megolm | End-to-end encrypted chat that keeps changing keys as you talk. | Designed so that one stolen key does not unlock your whole history. |
How they work together
A chat app uses public-key tools to agree on a secret with your friend, then uses a symmetric cipher like AES to lock each message, and hashing and signatures to make sure nothing was tampered with. TLS wraps the connection to the server on top. Cocoshell chats run on Matrix, which uses Olm for one-to-one conversations and Megolm for group chats.
Encryption that failed
Old methods get broken, which is why standards keep moving.
- DES (56-bit key) was cracked in the late 1990s and is long retired.
- WEP, an early Wi-Fi protection, can be broken in minutes.
- MD5 and SHA-1 are no longer trusted for security.