Encryption converts readable data (plaintext) into scrambled, unreadable data (ciphertext) using a mathematical algorithm and a key, so that only someone with the correct key can decrypt and read it. Symmetric encryption uses the same key to encrypt and decrypt, requiring that key to be shared securely beforehand. Asymmetric encryption uses a public key (which can be shared openly) to encrypt and a private key (kept secret) to decrypt, solving the problem of securely sharing keys over an insecure network like the internet.
Example
When you visit a website with "https" and a padlock icon, your browser and the website use asymmetric encryption to securely establish a shared connection, protecting data like passwords or card details from being read by anyone intercepting the traffic.
Key terms
Encryption:
Converting readable data into scrambled, unreadable data using a key.
Symmetric encryption:
Encryption using the same key to both encrypt and decrypt.
Asymmetric encryption:
Encryption using a public key to encrypt and a private key to decrypt.
Questions
1. Encryption converts:
Readable data into scrambled, unreadable data
Unreadable data into meaningless noise permanently
Nothing; it has no real effect on data
Data into a physical, printed document only
2. Symmetric encryption uses:
The same key to encrypt and decrypt
Two completely unrelated, different keys
No key at all
A key that is never kept secret
3. Asymmetric encryption uses:
A public key to encrypt and a private key to decrypt
Only one single shared key for everything
No key of any kind
A key that must always be printed on paper
4. Plaintext refers to:
Readable, unencrypted data
Scrambled, encrypted data
A type of computer virus
A type of encryption key only
5. Ciphertext refers to:
Scrambled, encrypted data
Readable, unencrypted data
A type of computer virus
A type of website address only
6. A padlock icon in a browser typically indicates:
The connection is encrypted
The website is definitely unsafe
No encryption is being used at all
The website has no security features
7. A private key in asymmetric encryption should be:
Kept secret
Shared publicly with everyone
Deleted immediately after creation
Printed on the website's homepage
8. Why must a symmetric encryption key be shared securely beforehand, unlike a public key in asymmetric encryption?
Anyone who obtains the symmetric key can both encrypt and decrypt data, so its distribution must be protected
Symmetric keys are never actually needed for encryption or decryption
Symmetric encryption never requires any key to be shared at all
Public keys in asymmetric encryption must also always be kept completely secret
9. Why does asymmetric encryption help solve the problem of sharing keys over an insecure network like the internet?
The public key can be shared openly without compromising security, since only the private key can decrypt
Asymmetric encryption requires both keys to be shared completely openly
Sharing any key over the internet is always completely insecure regardless of method
Asymmetric encryption does not actually use any keys at all
10. Why is encryption important for protecting sensitive data like passwords or banking details online?
It prevents the data from being read if intercepted by someone without the correct decryption key
Encryption has no effect on how safely data can be transmitted
Sensitive data is always safe to send without any encryption at all
Encryption only ever protects data stored on a device, never data being transmitted
11. A website using "https" rather than "http" indicates:
The connection is encrypted
The website is definitely a scam
No data is being transmitted at all
The website has no server behind it
12. Why might symmetric encryption still be used alongside asymmetric encryption in many real systems (like HTTPS)?
Symmetric encryption is generally faster for large amounts of data, once a secure key exchange has occurred via asymmetric methods
Symmetric and asymmetric encryption can never be used together in any system
Asymmetric encryption is always faster than symmetric encryption for large data
Using two types of encryption together always weakens overall security
13. Why might a weak or easily guessed encryption key undermine even a strong encryption algorithm?
The strength of encryption often depends on both a strong algorithm and a sufficiently complex, unpredictable key
Algorithm strength is the only factor that matters, regardless of key strength
Weak keys have no impact on how easily encrypted data can be accessed
Encryption security depends entirely on the key, with no role for the algorithm
14. Why is it computationally difficult (in current systems) to derive a private key from its corresponding public key?
Asymmetric encryption relies on mathematical problems that are practically very hard to reverse without the private key
Public and private keys are always mathematically identical to each other
Deriving a private key from a public key is trivial and requires no computation
Asymmetric encryption does not rely on any mathematical relationship between keys
15. Why might encryption alone not be sufficient to guarantee complete data security for an organisation?
Other vulnerabilities — like weak passwords, poor access controls or human error — can still expose data despite encryption
Encryption alone always guarantees complete, unbreakable security with no other measures needed
Data security has no connection to factors like human error or access control
Organisations never need to consider security beyond encryption alone
16. Why might governments and businesses debate the balance between strong encryption (protecting privacy) and law enforcement access (investigating crime)?
Strong encryption that protects privacy can also make it harder for authorities to access data during legitimate investigations
This tension has never been raised or discussed in any real policy debate
Encryption strength has no connection to privacy or law enforcement concerns
Privacy protection and law enforcement access are always perfectly aligned with no tension
17. A message encrypted with a recipient's public key can only be decrypted using:
The recipient's matching private key
Any public key belonging to anyone
No key at all
The sender's own private key
18. Storing passwords as unencrypted plaintext in a database is considered:
A serious security risk
A recommended best practice
Completely irrelevant to security
A requirement of most encryption standards
19. Why might a company use encryption for data both "in transit" (being sent) and "at rest" (being stored)?
Data can be vulnerable to interception during transmission and to unauthorised access while stored, so both need protection
Data is only ever vulnerable while being transmitted, never while stored
Encrypting stored data has no security benefit whatsoever
Only one of these two states ever requires any form of protection
20. Why might the length and complexity of an encryption key affect how difficult it is to break through brute-force guessing?
Longer, more complex keys create a vastly larger number of possible combinations to try, making brute-force attacks far less practical
Key length and complexity have no bearing on how easily an encryption can be broken
Shorter keys are always more secure than longer, more complex ones
Brute-force attacks are never affected by the size of the key space
21. Why might messaging apps advertising "end-to-end encryption" be considered more private than apps without it?
Only the sender and recipient can decrypt the messages, meaning even the app provider cannot read the content
End-to-end encryption means anyone, including the app provider, can freely read every message
This type of encryption has no actual effect on who can access message content
Apps without end-to-end encryption are always exactly as private as those with it
Answer key (parent copy)
1. Readable data into scrambled, unreadable data
2. The same key to encrypt and decrypt
3. A public key to encrypt and a private key to decrypt
4. Readable, unencrypted data
5. Scrambled, encrypted data
6. The connection is encrypted
7. Kept secret
8. Anyone who obtains the symmetric key can both encrypt and decrypt data, so its distribution must be protected
9. The public key can be shared openly without compromising security, since only the private key can decrypt
10. It prevents the data from being read if intercepted by someone without the correct decryption key
11. The connection is encrypted
12. Symmetric encryption is generally faster for large amounts of data, once a secure key exchange has occurred via asymmetric methods
13. The strength of encryption often depends on both a strong algorithm and a sufficiently complex, unpredictable key
14. Asymmetric encryption relies on mathematical problems that are practically very hard to reverse without the private key
15. Other vulnerabilities — like weak passwords, poor access controls or human error — can still expose data despite encryption
16. Strong encryption that protects privacy can also make it harder for authorities to access data during legitimate investigations
17. The recipient's matching private key
18. A serious security risk
19. Data can be vulnerable to interception during transmission and to unauthorised access while stored, so both need protection
20. Longer, more complex keys create a vastly larger number of possible combinations to try, making brute-force attacks far less practical
21. Only the sender and recipient can decrypt the messages, meaning even the app provider cannot read the content