Cryptography

Cryptography is the practice of protecting information with mathematical techniques so that only the intended people can read it, alter it, or confirm where it came from. The U.S. National Institute of Standards and Technology (NIST) describes it as the principles, means and methods that provide information security, including confidentiality, data integrity, authentication and non-repudiation. Almost every secure connection on the internet, from online banking to messaging apps, depends on it.

History of cryptography

People have hidden messages for thousands of years, first by swapping or rearranging letters by hand. In the twentieth century, cipher machines automated the work. The best known is the Enigma machine, which German forces used during World War II and whose rotors scrambled each letter differently as the operator typed.

Computers changed the field from a craft into a branch of mathematics. In 1976 Whitfield Diffie and Martin Hellman described public-key cryptography, in which two parties can establish secrecy without first meeting to swap a secret. In 1977 Ron Rivest, Adi Shamir and Leonard Adleman published the RSA system, which relies on the difficulty of factoring the product of two large prime numbers.

Government standards then spread strong cryptography beyond the military. NIST announced the development of the Advanced Encryption Standard (AES) on January 2, 1997, and called for candidate algorithms in September of that year. It named 15 candidates on August 20, 1998, chose five finalists (MARS, RC6, Rijndael, Serpent and Twofish), and announced on October 2, 2000 that it had selected Rijndael. AES was published as FIPS 197 on November 26, 2001.

How cryptography works

A cryptographic system takes readable data, called plaintext, and applies an algorithm together with a secret value called a key to produce unreadable ciphertext. Someone who holds the correct key can reverse the process. Modern designs assume that attackers know the algorithm, so security rests on the key staying secret and on the key being long enough that guessing it is impractical.

Key length matters because each added bit doubles the number of possible keys. NIST required the AES competition entries to support key sizes of 128, 192 and 256 bits, and the finished standard works on blocks of 128 bits. Open, public review is also part of how trust is built: the AES candidates were analyzed by the global cryptographic community for years before one was chosen.

Cryptography also depends on good randomness. Keys generated by a predictable process can be guessed even when the algorithm is sound, which is why standards bodies publish requirements for random number generation and for testing implementations.

Types of cryptography

Symmetric cryptography uses one shared key to lock and unlock data. It is fast, so it protects bulk data such as files, disk contents and the traffic of a web session. AES is the most widely used standard of this kind, and it is a block cipher, meaning it processes data in fixed-size chunks.

Asymmetric, or public-key, cryptography uses a pair of linked keys: a public key that anyone may see and a private key that its owner keeps secret. It is slower than symmetric methods, so it is usually used to exchange a symmetric key or to create digital signatures. RSA and elliptic-curve systems are common examples.

A third family is the cryptographic hash function, which turns any input into a short fixed-length fingerprint. Changing a single character of the input changes the output completely, and the process cannot practically be run backward. Hashes are used to check file integrity and to store passwords safely.

A digital signature combines a hash with a private key. It lets a recipient check that a document or software update came from a particular signer and was not changed on the way.

Applications of cryptography

The padlock in a web browser reflects a protocol that uses public-key methods to set up a connection and symmetric methods to protect the data that follows. Messaging apps use similar tools so that only the sender and recipient can read a message. Payment cards, electronic passports and software update systems all rely on signatures and keys to prove that data is genuine.

Cryptography is also the foundation for encryption of stored data, for secure remote work over virtual private networks, and for the verification of records in systems such as blockchains. Where a secret must be proven without being revealed, as in some login schemes, cryptographic protocols let one party demonstrate knowledge of it without sending it.

Advantages and disadvantages of cryptography

The main advantage is that well-designed cryptography gives strong protection that does not depend on hiding the method. A system built on a vetted standard can be checked by anyone, and it protects data wherever it travels or is stored.

The limits are practical. Keys must be generated, stored and replaced safely, and many real-world breaches come from poor key handling or flawed software, not from broken mathematics. Cryptography also protects only data that is encrypted: a compromised device can expose information before it is locked or after it is unlocked.

A longer-term concern is quantum computing. NIST says quantum computers that could break many of today’s public-key systems may be years or decades away, but it has already acted. In August 2024 it released three post-quantum standards: FIPS 203, based on the ML-KEM key-encapsulation mechanism, and FIPS 204 and FIPS 205, which define the ML-DSA and SLH-DSA digital signature schemes. Under its transition plan, NIST will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems moving sooner.

Cryptography vs. encryption

The two terms are often used as if they meant the same thing, but encryption is only one part of cryptography. Encryption turns data into a form that hides its content. Cryptography is the wider field, which also covers hashing, digital signatures, key exchange and the protocols that combine them.

A related field is cryptanalysis, the study of breaking cryptographic systems. The two grow together, since every public attack on a design is evidence that shapes the next standard. The information here is general background, and specific security decisions should follow current official guidance.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 4, 2026Researched and drafted with AI assistanceReport an issue