Symmetric encryption
Understand shared-key encryption
Use one secret key for encryption and decryption and recognize that safely distributing and storing that key is the central problem.
8 minute lesson
Symmetric encryption uses the same secret key to protect and recover data. It is fast and works well for stored data and large messages.
Anyone with the key can decrypt and usually create valid ciphertext. Keep the key separate from the data it protects where possible. If every application instance needs the key, each one becomes part of the threat model.
Every application replica receives the same master key in an environment variable. One compromised debug endpoint can expose the key and every record protected by it.
Central key storage can narrow access and record operations, but each service allowed to decrypt remains trusted. Separate keys by environment, tenant, or purpose when the blast-radius reduction justifies the operational cost.
Create a key-access map for one encrypted field, including developers, CI, application replicas, backups, and recovery jobs. Save the effective permissions for each identity. Then revoke one test replica and prove it can no longer decrypt while another authorized replica still can.
Lesson completed