In the digital age, encryption algorithms serve as the “digital locks” that ensure information security. Their core essence is to transform plaintext (original information) into ciphertext that cannot be directly recognized, allowing only the recipient with the “key” (secret key) to restore the ciphertext back to plaintext, thus achieving secure transmission and storage of information.
1. Two Camps of Encryption Algorithms: Symmetric and Asymmetric
(1) Symmetric Encryption: One Key Opens One Lock
Symmetric encryption uses a single key, where the same “key” is used for both encryption and decryption, similar to using the same key to lock and unlock a door.
-
Core Features: Extremely fast operation speed, suitable for processing large volumes of data (such as file encryption), but there are security risks during the key transmission process.
-
Typical Algorithms:
-
AES (Advanced Encryption Standard): Currently the most widely used, such as Wi-Fi encryption and mobile payment data transmission, supports key lengths of 128 bits, 192 bits, and 256 bits. The 256-bit AES encryption strength is extremely high and has not been cracked to date.
-
DES (Data Encryption Standard): An early mainstream algorithm, gradually replaced by AES due to its insufficient security with a key length of only 56 bits.
-
Application Scenarios: Local file encryption, encryption of sensitive fields in databases, instant messaging message encryption (such as WeChat chat content encryption).
(2) Asymmetric Encryption: One Lock with Two Keys
Asymmetric encryption has a pair of keys, namely a public key (which can be publicly disseminated) and a private key (which is kept only by the holder). Data encrypted with the public key can only be decrypted with the corresponding private key; data encrypted with the private key can only be decrypted with the corresponding public key, similar to a delivery locker where the public key is the “storage code” (public) for the delivery person, and the private key is the “pickup code” (private) for the user.
-
Core Features: High security, no need to worry about key transmission risks, but slower operation speed, not suitable for large volume data encryption.
-
Typical Algorithms:
-
RSA: The most widely used asymmetric encryption algorithm, commonly used for key exchange (such as the transmission of symmetric keys in HTTPS protocol) and digital signatures, with key lengths typically of 2048 bits or 4096 bits.
-
ECC (Elliptic Curve Cryptography): At the same encryption strength, the key length is much smaller than RSA (for example, 256-bit ECC encryption strength is equivalent to 3072-bit RSA), suitable for resource-constrained scenarios such as mobile devices and the Internet of Things.
-
Application Scenarios: HTTPS protocol encryption (the small green lock in the website address bar), digital certificate issuance, Bitcoin and other cryptocurrency transaction signatures.
In-depth Analysis for Interviews: The 5 Major Scopes of Spring Beans, Covering Definitions to Source Code Level Points
2. The “Golden Partner” of Encryption Algorithms: Hybrid Encryption Mode
Symmetric encryption is fast but insecure in key transmission, while asymmetric encryption is highly secure but slow. In practical applications, a “hybrid encryption” mode is usually adopted, combining the advantages of both, similar to delivery logistics: first, use asymmetric encryption (private key) to lock the “symmetric key” (delivery key) in a “secure box,” and then use symmetric encryption (symmetric key) to quickly encrypt a large number of “delivery items” (plaintext data).
For example, in the HTTPS protocol, the specific process is as follows:
-
The client initiates a request to the server, and the server sends the public key (along with the digital certificate) to the client.
-
After the client verifies the validity of the public key, it generates a random symmetric key, encrypts this symmetric key with the server’s public key, and sends it to the server.
-
The server decrypts it with its private key to obtain the symmetric key.
-
All subsequent data transmissions between the client and server are encrypted and decrypted using this symmetric key.
3. Confusing Concepts: Encryption vs. Hashing
Many people confuse hashing with encryption, but in essence, they are different. Encryption is “reversible” (the plaintext can be restored with a key), while hashing is “irreversible” (the original data cannot be inferred from the hash value).
-
Hash Algorithms: Transform any length of input into a fixed length output (hash value) through a hash function, common algorithms include MD5 and SHA-256.
-
Core Differences:
-
Encryption: Reversible, requires a key, aimed at “secure transmission”.
-
Hashing: Irreversible, does not require a key, aimed at “data verification” (such as file checksum) and “password storage” (storing hashed values of user passwords in databases instead of plaintext).
4. Frequently Asked Interview Questions: 3 Core Points to Address
Q: What is the difference between AES and RSA? How to choose in actual projects?
A: The core difference lies in the number of keys and operation speed. AES is symmetric encryption with a single key, fast, suitable for large files and high-frequency data encryption; RSA is asymmetric encryption with two keys, slow, suitable for small data (such as symmetric key) transmission and digital signatures. In actual projects, a hybrid mode is usually adopted, using RSA to transmit the AES key and AES to encrypt business data.
Q: Is the MD5 hash value fixed? Why can’t MD5 be used to store passwords?
A: The MD5 hash value for the same input is fixed (the “determinism” of hash algorithms). MD5 cannot be used to store passwords because it has a “collision” risk (different inputs may generate the same hash value), and hackers can quickly crack simple passwords using a “rainbow table” (a precomputed table of plaintext-hash value pairs). The current mainstream practice is to use SHA-256 combined with a “salt” (random string) to store passwords.
Q: How does the HTTPS protocol ensure data security? What encryption algorithms are used?
A: HTTPS ensures security through “certificate verification + hybrid encryption”. First, it verifies the server’s identity through a digital certificate to prevent “man-in-the-middle attacks”; then it uses RSA (or ECC) algorithms to transmit the symmetric key and AES (or ChaCha20) algorithms to encrypt subsequent transmitted data, while also using hash algorithms (such as SHA-256) to verify data integrity and prevent data tampering.
Never Fear Interview Questions About MySQL MVCC Again with This Article