Encryption & Decryption in Software Development: Types, Algorithms, Best Practices

Basic Concepts

Encryption transforms readable plaintext into unreadable ciphertext, while decryption restores ciphertext to its original plaintext. Both processes require a secret key, analogous to a physical lock and key.

Symmetric Encryption

Symmetric encryption uses the same key for both encryption and decryption. The article uses a simple analogy: two friends share one lock key; one locks a box (encrypts) and the other unlocks it (decrypts).

Key characteristics:

Very fast, suitable for large volumes of data such as files or API messages.

Key distribution is a critical challenge—if the key is intercepted during transmission, all encrypted data is compromised.

Common algorithms: AES (industry standard) and DES (outdated, discouraged). Typical scenario: encrypting long text blocks or files within an internal network. A concrete example shows plaintext "用户姓名张三" encrypted with key "123456abc" producing unreadable ciphertext that can only be recovered with the identical key.

Asymmetric Encryption

Asymmetric encryption employs a key pair: a public key that anyone can use to encrypt data, and a private key that only the owner can use to decrypt. The article likens the public key to a publicly posted lock that anyone can lock, while the private key is the only key that can open it.

Rules:

Data encrypted with the public key can only be decrypted with the matching private key.

Data signed with the private key can be verified with the public key.

Common algorithms: RSA (widely used) and SM2 (Chinese national standard for government and enterprise projects). A typical use case: a client encrypts a message with the server’s public key; even if an attacker captures the ciphertext, it cannot be decrypted without the server’s private key.

Important limitation: RSA cannot encrypt long texts—only short strings (a few hundred characters). Therefore, RSA is rarely used directly for business payloads.

Digital Signatures

The article clarifies that a digital signature is not encryption. Signing with a private key proves the message’s origin and integrity; anyone can verify the signature with the public key, but the signed data remains readable.

Hash Algorithms

Hash functions produce a fixed‑length digest from input of arbitrary length and are one‑way: they cannot be reversed. The article uses the analogy of extracting juice from fruit—once juiced, you cannot reconstruct the original fruit.

Common algorithms: MD5 (insecure, should not be used for passwords), SHA256 (Internet mainstream), and SM3 (Chinese national standard).

Typical application: password storage. Correct workflow:

User registers: password → SHA256 hash → store hash.

User logs in: input password → SHA256 hash → compare with stored hash.

The server never stores the raw password.

To mitigate rainbow‑table attacks, the article recommends adding a random salt to the password before hashing.

Hybrid RSA‑AES Scheme (Industry Standard)

Because symmetric encryption is fast but suffers from key‑distribution risk, and asymmetric encryption is secure but slow and limited to short data, the common practice combines both:

Client generates a temporary AES key.

Client encrypts the bulk data with AES.

Client encrypts the temporary AES key with the server’s public RSA key.

Client sends both the AES‑encrypted data and the RSA‑encrypted AES key.

Server uses its private RSA key to recover the AES key.

Server decrypts the data with the recovered AES key.

This approach balances speed and security and is used in most external‑interface encryption solutions.

HTTPS Underlying Mechanism

HTTPS = HTTP (plain) + TLS (encryption). The TLS handshake uses asymmetric encryption to exchange a temporary symmetric key; subsequent HTTP payloads are transmitted using symmetric encryption, following the same hybrid pattern described above.

Additional Frequently Heard Terms

SM2 (asymmetric), SM3 (hash), SM4 (symmetric, similar to AES) – mandated in Chinese government, state‑owned, and financial projects.

Base64 – an encoding, not encryption; it can be decoded directly and provides no security. Misusing Base64 as a protection mechanism leads to serious vulnerabilities.

Common Pitfalls (Frequent Interview Topics)

Avoid DES and MD5 for security‑critical encryption; they are obsolete.

Never use Base64 as a substitute for encryption.

Never store passwords with a plain hash; always add a random salt.

Do not encrypt long messages directly with RSA; instead, use a hybrid RSA‑AES approach.

Clearly distinguish between encryption (confidentiality) and digital signatures (authenticity and integrity).