Data encryption: a safe with instructions on the door

The Central Document Warehouse, named after its Manager, has new servers, RAID, backups, a recovery plan and an accountant with extraordinary patience. After the fire, the deleted document and the freezer incident, the manager decides to make the company completely secure. He buys a giant safe, three padlocks and declares: “FROM TODAY, WE ENCRYPT EVERYTHING!” There's just one tiny problem. An hour later even he can't open anything. Welcome to data encryption — protecting information from the wrong people without locking yourself out too.

Chapter one: a safe with opening instructions on the door

— FRANK! THIEVES WILL NEVER GET OUR DATA!
— Wonderful, boss. What did you do?
— LOCKED THE DISK IN A SAFE!
— And the key?
— HANGING ON THE DOOR, SO NOBODY LOSES IT!
— ...
— WHY ARE YOU LOOKING AT ME LIKE THAT?!
— A safe is meant to keep out people who shouldn't open it.
— WELL, IT IS LOCKED!
— With opening instructions outside.
— **THEN ENCRYPT THE INSTRUCTIONS!**

🤣🤣🤣

Encryption turns readable information into a form that should be unintelligible without the correct key. The unreadable result is called ciphertext. The reverse operation is decryption.

Encryption primarily protects confidentiality. It can turn a stolen disk into a collection of meaningless information for the thief, but it doesn't automatically prevent deletion or replace a backup. A padlock won't put out a warehouse fire.

Chapter two: encryption, encoding and hashing are different things

A sheet of paper lands on Frank's desk.

— FRANK! I'VE ENCRYPTED A CONFIDENTIAL DOCUMENT!
— With what?
— BASE64!
— That's encoding, not encryption.
— BUT THE LETTERS LOOK LIKE GIBBERISH!
— Anybody can decode it. No secret needed.
— THEN A HASH?!
— Hashing serves different purposes. It's not how you store a document you intend to decrypt later.
— SO NOT EVERY WEIRD STRING IS ENCRYPTED?!
— Exactly.
— **GENTLEMEN, COMPUTING ONCE AGAIN PROVES LOOKS CAN BE DECEIVING!**

🤣🤣

Encoding, such as Base64, changes how information is represented so it can be transferred or stored in a particular format. It offers no secrecy. Hashing calculates a usually short fingerprint of data, often used to check integrity; you cannot simply reverse a proper cryptographic hash to reconstruct the original document. Passwords should be stored using specialised, salted, deliberately slow password-hashing functions such as Argon2id, not plain fast SHA-256.

Encryption is different: it is designed to let someone with the correct key recover the information. Random-looking characters aren't automatically secure.

Chapter three: one key locks and unlocks the safe

— FRANK, MAKE IT SIMPLE!
— Imagine a safe where you use the same secret key to lock and unlock what's inside.
— A NORMAL SAFE?!
— The idea is similar. That's symmetric encryption.
— IS IT FAST?!
— Very. It's well suited to protecting large amounts of data.
— THEN ENCRYPT THE WHOLE WAREHOUSE!
— We can encrypt its disks. The walls don't really need it.
— **STOP LIMITING MY VISION!**

🤣🤣

Symmetric encryption uses one secret key to encrypt and decrypt data, or keys directly derived from that shared secret. One widely used, well-established algorithm is AES, available with 128-, 192- and 256-bit keys. AES-256 doesn't mean your password must contain 256 characters; the encryption key and a password from which one can safely derive a key are different concepts.

The mode of operation and the implementation also matter. Files and messages often use authenticated encryption such as AES-GCM, which can detect unauthorised ciphertext modifications as well as protect secrecy. A box labelled “AES” isn't automatically secure just because of the label.

Chapter four: public keys, private keys and an overly sociable manager

— FRANK! FIRST YOU SAY THE KEY MUST BE SECRET, NOW IT'S “PUBLIC”?!
— There is also asymmetric cryptography. It uses a pair of related keys: public and private.
— SO I GIVE ONE TO EVERYONE?!
— You can share the public one.
— AND THE PRIVATE ONE?!
— Protect it.
— SHALL I EMAIL IT TO THE STAFF WITH “SECRET” IN THE SUBJECT?!
— No, because it would stop being secret.
— **BUT I'LL USE CAPITAL LETTERS!**

🤣🤣

In some systems, a public key can be used to encrypt a secret intended for the holder of the corresponding private key. Other systems use the pair for digital signatures: the private key signs and the public key verifies. Not every asymmetric algorithm supports every use.

For example, RSA can be used in specific encryption and signature schemes, ECDSA is for signatures, and ECDH establishes a shared secret. Similar names, different jobs.

Chapter five: why modern encryption often combines the two

— FRANK, WHICH KIND OF ENCRYPTION IS BETTER?!
— Depends on the job. Symmetric cryptography is efficient for big files. Asymmetric systems can help establish or protect keys and authenticate participants, depending on the protocol.
— THEN COMBINE THEM!
— Modern systems often do exactly that.
— SEE?! I WAS RIGHT AGAIN!
— You've just reinvented hybrid cryptography, boss.
— **PUT IT IN THE MINUTES: “I INVENTED THE INTERNET”!**

🤣🤣

Many real-world systems combine cryptographic techniques. Data is encrypted with an efficient symmetric algorithm, while asymmetric cryptography helps establish or protect keys and verify identities. Modern TLS connections, used by HTTPS, are an example of this broader approach.

One important detail: HTTPS does not mean the entire web server is encrypted. It protects data in transit between properly authenticated connection endpoints. Data may be readable after decryption at the server or on a user's device. We explain certificates in our certificates article and HTTP versus HTTPS in a separate story.

Chapter six: disk encryption isn't the same as file encryption

— FRANK! MY DISK IS ENCRYPTED! NOBODY CAN SEE MY DOCUMENTS!
— It's a major advantage if a correctly protected, powered-off disk is stolen.
— AND WHEN THE COMPUTER IS RUNNING?!
— After unlocking, authorised applications and users can access files. Malware with sufficient privileges might be able to read them too.
— THEN I'LL NEVER TURN IT ON!
— Nobody will get any work done either.
— **SECURITY ABOVE ALL!**

🤣🤣

Full-disk encryption, using tools such as BitLocker, FileVault or LUKS/dm-crypt, protects data at rest, particularly if a powered-off device is lost. Once unlocked, the operating system uses files normally; disk encryption doesn't guard against every threat during an active session.

Encrypting a file or archive protects selected data, for example before sending a backup to the cloud. Encrypting network traffic protects information while it travels. In every case ask what is protected, when, and from whom. None of these mechanisms alone provides complete data security.

Chapter seven: the password taped to the drive

The accountant enters carrying her famous drive from under the socks.

— Boss, I've encrypted the archive.
— EXCELLENT! WHERE'S THE PASSWORD?!
— Secured separately.
— SEPARATELY?! I TAPED MINE TO THE DISK!
— That might help a thief.
— THEN I'LL PEEL IT OFF!
— Where will you keep it?
— IN MY HEAD!
— And the emergency copy?
— **GENTLEMEN, STOP ASKING ME TO BACK UP MY BRAIN!**

🤣🤣🤣

Encryption keys, passwords and recovery methods need as much planning as the data copies themselves. Long, unique passwords and secure key-derivation methods can protect archives. Particularly important data also needs an independent way to recover its key.

A password written on paper is not inherently a bad solution. A properly protected paper copy kept separately from the drive can be a reasonable emergency fallback. Taping the password to the encrypted drive is another matter. So is having exactly one key that nobody can recover.

Chapter eight: the manager encrypts the password to his password

— FRANK! I'VE INVENTED THE PERFECT SYSTEM!
— What is it?
— THE BACKUP PASSWORD GOES IN AN ENCRYPTED FILE!
— Good. How do we decrypt that file?
— WITH ANOTHER PASSWORD!
— Where is that one?
— IN ANOTHER ENCRYPTED FILE!
— And the password for that?
— IN A THIRD!
— Where does this chain end?
— ...
— Boss?
— **STOP RUINING INFINITY WITH YOUR QUESTIONS!**

🤣🤣

Security needs a real emergency recovery procedure. A password manager, recovery keys stored separately, protected credentials, access delegated to a small number of authorised people, or a sealed recovery envelope can all play a part. If your phone is lost, the password manager becomes unavailable or one particular employee is absent, an independent recovery route should exist.

That doesn't mean every employee should have access to the key. Quite the opposite: only people who genuinely need access should receive it, while emergency procedures remain thought through and tested. A system nobody can operate or recover isn't improved by its complexity.

Chapter nine: a padlock doesn't stop a hammer

— FRANK! THE DISK IS ENCRYPTED! IT'S INDESTRUCTIBLE!
— No, boss.
— WHAT?!
— Encryption doesn't repair hardware, prevent fires or restore deleted files.
— WHAT ABOUT RANSOMWARE?!
— It can encrypt or delete accessible files even when the underlying disk is already encrypted.
— SO I CAN HAVE ENCRYPTED FILES ON AN ENCRYPTED DISK?!
— Yes. And still have no working documents.
— **IT'S LIKE A SAFE INSIDE A SAFE THAT DOESN'T EXIST!**

🤣🤣

Confidentiality means controlling who can read information. Integrity means whether information has been altered without authorisation. Availability means being able to use it when needed. They are distinct goals. Encryption primarily helps confidentiality; appropriate authenticated-encryption systems can also detect tampering. It doesn't automatically deliver availability or disaster recovery.

That's why backups are still essential, while data recovery remains its own subject. Encryption and backups aren't rivals. They solve different problems.

Chapter ten: an attacker doesn't need to break AES

— FRANK! WE USE AES-256! NOBODY CAN TOUCH US!
— And the administrator's password is “123456”?
— ...
— The machine stays unlocked and logged in?
— ...
— Someone sent a fake sign-in page to an employee?
— ...
— Boss?
— **CHANGE EVERYONE'S PASSWORD TO “AES256” IMMEDIATELY!**

🤣🤣

In the real world, attackers often don't try to mathematically break a strong cipher. It's easier to steal credentials, compromise an account, exploit software bugs, replace an installer, abuse overly broad permissions or access files while the computer is already unlocked.

That's why we combine encryption with updates, strong authentication, sensible permissions, device security, key protection and thoughtful configuration. The security of the entire system is not the same thing as the algorithm name in its settings.

Chapter eleven: can any cipher be guaranteed forever?

— GENTLEMEN! I WANT ENCRYPTION THAT RESISTS EVERYTHING FOR THE NEXT HUNDRED YEARS!
— Nobody can honestly guarantee absolute security forever.
— NOT EVEN IF I PAY EXTRA?!
— Not even then. Attacks, software and computing capabilities evolve.
— WHAT ABOUT QUANTUM COMPUTERS?!
— They could seriously threaten some current public-key cryptography in the future.
— SO THEY'LL CRACK ALL OUR DRIVES TOMORROW?!
— No. That's not how it works.
— **FRANK, I CAN'T DECIDE WHETHER TO FEAR THIEVES OR PHYSICISTS!**

🤣🤣

A sufficiently capable quantum computer could undermine widely used RSA and elliptic-curve cryptography. That's why post-quantum algorithms are being developed and adopted for appropriate uses. This does not mean today's quantum computers can routinely decrypt properly protected company data.

AES-256 does not face the same type of quantum threat as RSA or ECC. Known quantum attacks on symmetric encryption are different, and properly implemented AES-256 remains a strong choice. In practice you must also consider how passwords become keys, implementation flaws, secret storage and how long the data must remain confidential.

Chapter twelve: a backup encrypted so well that nobody can read it

— BOSS! WE HAVE THREE COPIES OF THE ARCHIVE!
— MARVELLOUS!
— ALL ENCRYPTED!
— EVEN BETTER!
— BUT NOBODY HAS THE RECOVERY KEY!
— ...
— ...
— **CAN'T WE RESTORE THE KEY FROM A BACKUP?!**
— The backup is encrypted with that very key.
— THEN KINDLY STOP TELLING ME THESE DETAILS!

🤣🤣🤣

Encrypting backups requires key storage, an independent emergency copy and tests proving the backups can actually be decrypted. Otherwise multiple archives can all be equally unreadable. Of course, don't keep the recovery key beside the drive where a thief can grab both.

A reasonable approach is to encrypt archives before uploading them to cloud storage, along with separate permissions and backup recovery arrangements. But encryption alone doesn't prevent deletion or overwriting archives: retention, independent access controls and other backup layers address those risks.

Chapter thirteen: digital signatures and the manager's rubber stamp

— FRANK! I'VE DIGITALLY SIGNED THE DOCUMENT!
— Excellent.
— SO NOBODY CAN READ IT NOW!
— Digital signatures don't conceal content.
— THEN WHAT ARE THEY FOR?!
— They help verify who signed the data and whether the signed content changed. You still need to trust the relevant keys or certificates.
— SO I CAN SIGN A PUBLIC DOCUMENT?!
— Of course.
— **THEN WHAT'S THE POINT OF MY “TOP SECRET” RUBBER STAMP?!**

🤣🤣

A digital signature isn't encryption. It allows verification of the signature's authenticity and signed data's integrity, provided the key is trusted. A hash can help detect changes too, but an ordinary hash pasted next to a document doesn't prove who created it: an attacker could alter the document and compute a new hash.

A document may be public and signed, secret and unsigned, or both encrypted and signed. Different purpose, different tool.

Chapter fourteen: a common-sense checklist

Four questions appear on the warehouse notice board:

1. What are we protecting? Photos, documents, personal information, laptops, backups or network traffic?

2. Against whom or what? Stolen drives, network eavesdropping, unwanted reading, stolen accounts or hardware loss?

3. Who should have access? The owner, a few administrators, designated staff or one intended recipient?

4. How do we recover access? What happens if a password, phone or key is lost? Can we restore and decrypt the backup?

— FRANK! ISN'T THERE ONE BIG BUTTON THAT SAYS “SECURE”?!
— No, but we can design a simple procedure that fits the risks.
— AND WE DON'T NEED TO BUILD FORT KNOX?!
— No. Just keep things proportionate and sensible.
— **THAT'S THE FIRST GOOD NEWS I'VE HAD ALL WEEK!**

🤣🤣

For home users, full-disk encryption on a laptop, a screen lock, strong passwords, updates and separately protected backups of important files can be a good start. Businesses should match their controls to data sensitivity, legal responsibilities and real threats. Protection so complicated that nobody can operate or recover it is not good protection.

Finale: the safest warehouse in the world

The grand opening of the new warehouse safe begins.

— GENTLEMEN! WE HAVE ENCRYPTED DISKS!
— Yes.
— ENCRYPTED BACKUPS IN OTHER LOCATIONS!
— Yes.
— RECOVERY KEYS PROTECTED SEPARATELY!
— Correct.
— AND WE'VE CHECKED THAT WE CAN DECRYPT EVERYTHING?!
— Yesterday. It worked.
— WONDERFUL! NOW LET'S OPEN THE SAFE!

The manager takes his key, walks up to the door and stops.

— FRANK...
— Yes?
— HAS SOMEONE ENCRYPTED THE LOCK?!
— No. You've inserted the key backwards.
— ...
— ...
— **DON'T PUT THAT IN THE REPORT!**

🤣🤣🤣🤣

Remember: encryption helps protect secrets, but it doesn't prevent every failure or replace backups. A strong algorithm needs proper implementation, safely protected keys and a way to recover them. The best encryption keeps unauthorised people out — not the data's rightful owner.

Management of the Central Document Warehouse confirms the safe was opened without the assistance of quantum computers. The accountant has refused to store this key under her socks. This time.