Cryptology Academy · Lesson

Encrypting Files with AES in Practice

Use OpenSSL and Python to encrypt and decrypt real files with AES.

Lesson 4 of 413 steps

Encrypting Files with AES in Practice is a free Cryptology Academy lesson on CoddyKit. This is lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Theory meets practice. In this lesson we encrypt and decrypt real files using AES-GCM in Python, the recommended mode for authenticated encryption.

Why AES-GCM?

AES-GCM provides Authenticated Encryption with Associated Data (AEAD). It encrypts AND produces a 16-byte authentication tag. Any tampering is detected before decryption.

AES-GCM Components

Inputs: 32-byte key, 12-byte random nonce, plaintext, optional associated data (AAD). Outputs: ciphertext, 16-byte authentication tag. Nonce must be unique per encryption.

Install cryptography Library

pip install cryptography The Python cryptography library by PyCA is the recommended crypto library. It wraps OpenSSL and provides both high-level recipes and low-level hazmat primitives.

AES-GCM Encrypt in Python

from cryptography.hazmat.primitives.ciphers.aead import AESGCM import os key = AESGCM.generate_key(bit_length=256) nonce = os.urandom(12) aad = b'file_version_1' aesgcm = AESGCM(key) ciphertext = aesgcm.encrypt(nonce, plaintext, aad)

AES-GCM Decrypt in Python

try: plaintext = aesgcm.decrypt(nonce, ciphertext, aad) except Exception: print('Decryption failed — tampered or wrong key') If the tag verification fails, decrypt() raises an exception. Never ignore this exception.

File Encryption Workflow

with open('input.bin', 'rb') as f: plaintext = f.read() ciphertext_with_tag = aesgcm.encrypt(nonce, plaintext, None) # Store: nonce (12 bytes) + ciphertext_with_tag with open('output.enc', 'wb') as f: f.write(nonce + ciphertext_with_tag)

File Decryption Workflow

with open('output.enc', 'rb') as f: data = f.read() nonce = data[:12] ciphertext_with_tag = data[12:] plaintext = aesgcm.decrypt(nonce, ciphertext_with_tag, None)

Nonce Management

A 12-byte random nonce with AES-GCM is safe for up to 2^32 encryptions with the same key before collision probability becomes non-negligible. After that, rotate the key.

Using OpenSSL on Command Line

# Encrypt: openssl enc -aes-256-cbc -pbkdf2 -in plain.txt -out encrypted.bin # Decrypt: openssl enc -d -aes-256-cbc -pbkdf2 -in encrypted.bin -out plain.txt Note: CBC mode — add -GCM flag for authenticated encryption in newer OpenSSL.

Key Storage Best Practices

Never hardcode keys in source code. Use environment variables, AWS KMS, HashiCorp Vault, or OS keychain. Rotate keys regularly. Revoke keys when personnel leave.

Quick Check

What happens when AES-GCM detects that the ciphertext has been tampered with?

Answer it in the interactive lesson

Recap

You can now encrypt files with AES-GCM in Python. Next we move to asymmetric encryption and learn RSA from the ground up.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “Encrypting Files with AES in Practice” lesson free?

Yes — the full text of “Encrypting Files with AES in Practice” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “Encrypting Files with AES in Practice”?

Use OpenSSL and Python to encrypt and decrypt real files with AES. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.

How long does the “Encrypting Files with AES in Practice” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy