Symmetric Encryption: AES and Stream Ciphers
Learn how symmetric ciphers work, key sizes, block vs stream ciphers, and modes of operation.
Symmetric Encryption: AES and Stream Ciphers is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is Symmetric Encryption?
Symmetric encryption uses the same key for both encryption and decryption. It is fast and efficient, making it ideal for bulk data encryption. The key distribution problem — how do two parties securely share the key — is its main challenge.
AES: Advanced Encryption Standard
AES is the global standard for symmetric encryption, adopted by NIST in 2001. It operates on 128-bit blocks with key sizes of 128, 192, or 256 bits. AES is used in TLS, disk encryption, Wi-Fi (WPA2), and countless other protocols.
AES Block Cipher Modes
Block cipher modes determine how AES handles data larger than one block:
- ECB — each block encrypted independently (insecure — reveals patterns)
- CBC — each block XORed with previous ciphertext (requires IV)
- GCM — authenticated encryption; provides both confidentiality and integrity (preferred)
- CTR — turns block cipher into stream cipher
Why GCM Mode is Preferred
AES-GCM provides Authenticated Encryption with Associated Data (AEAD): encryption + integrity check in one operation. Any tampering with the ciphertext is detected. Used in TLS 1.3 and modern protocols. Always prefer GCM over CBC for new systems.
Stream Ciphers
Stream ciphers encrypt data one bit or byte at a time using a pseudorandom keystream XORed with plaintext. Examples: RC4 (broken), ChaCha20 (modern, used in TLS 1.3). Stream ciphers are efficient for variable-length data and hardware-constrained environments.
ChaCha20-Poly1305
ChaCha20-Poly1305 is a modern AEAD cipher used in TLS 1.3 and WireGuard. ChaCha20 is the stream cipher; Poly1305 provides the authentication tag. It performs better than AES on devices without hardware AES acceleration (mobile, IoT).
The Key Distribution Problem
Both parties must have the same key, but how do they exchange it securely? Options:
- Pre-shared key (physical exchange)
- Key encapsulation with asymmetric encryption
- Diffie-Hellman key exchange over an untrusted channel
AES Key Sizes
AES-128 provides sufficient security for most uses. AES-256 is used for top-secret data and post-quantum considerations. The extra overhead of AES-256 vs AES-128 is minimal with hardware acceleration (AES-NI CPU instructions).
Symmetric Encryption in Practice
Examples of symmetric encryption use:
# Encrypt a file with AES-256-CBC using OpenSSL:
openssl enc -aes-256-cbc -pbkdf2 -in file.txt -out file.enc
# Decrypt:
openssl enc -d -aes-256-cbc -pbkdf2 -in file.enc -out file.txtDisk Encryption
Full disk encryption (FDE) uses symmetric encryption to protect data at rest:
- BitLocker (Windows) — AES-XTS-128 or 256
- FileVault 2 (macOS) — AES-XTS-128
- LUKS (Linux) — configurable, typically AES-XTS-256
Broken Algorithms to Avoid
Never use these for new systems:
- DES — 56-bit key, broken since 1999
- 3DES — slow, deprecated in TLS
- RC4 — stream cipher with multiple weaknesses
- ECB mode — leaks data patterns (the "ECB penguin")
Quick Check: Symmetric Encryption
Which AES mode provides both confidentiality and integrity (authenticated encryption) and is preferred in modern protocols?
Lesson Recap
Symmetric encryption uses one key for encrypt/decrypt. AES is the standard, with GCM mode preferred for authenticated encryption. ChaCha20-Poly1305 is the modern alternative for resource-constrained devices. Avoid DES, 3DES, RC4, and ECB mode. Key distribution requires asymmetric cryptography or Diffie-Hellman.
Frequently asked questions
Is the “Symmetric Encryption: AES and Stream Ciphers” lesson free?
Yes — the full text of “Symmetric Encryption: AES and Stream Ciphers” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Symmetric Encryption: AES and Stream Ciphers”?
Learn how symmetric ciphers work, key sizes, block vs stream ciphers, and modes of operation. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Symmetric Encryption: AES and Stream Ciphers” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Symmetric Encryption: AES and Stream Ciphers
- Asymmetric Encryption: RSA and Elliptic Curves
- Hash Functions: SHA-256 and Beyond
- Digital Signatures and Certificates