Symmetric Encryption Fundamentals

Prerequisites: Python 3.10+; basic comfort with the terminal and pip; no prior cryptography experience needed.

Verified against the pyca/cryptography documentation (cryptography.io) and OWASP's Cryptographic Storage Cheat Sheet, July 2026. Targets cryptography 49.0.0 (current stable on PyPI as of June 2026); code examples use only the stable hazmat.primitives.ciphers.aead and fernet modules, which have been stable across the 4x/49x series. The library's precompiled wheels currently bundle OpenSSL 3.5.x; OpenSSL itself moved to a new major version, 4.0, in April 2026, but that upgrade is transparent at this API level — nothing here depends on which OpenSSL point release is linked underneath.

Symmetric encryption uses the same key to encrypt and decrypt — fast, and the right choice for bulk data, but it has a problem plain "encryption" doesn't solve on its own: an attacker who can flip bits in your ciphertext can often flip predictable bits in your plaintext, even without knowing the key. That's why virtually everything you'll write in modern code is AEAD (Authenticated Encryption with Associated Data) — a construction that gives you confidentiality and integrity/authenticity in one call, and rejects ciphertext outright if it's been tampered with rather than silently decrypting garbage.

This project works entirely with AES-256-GCM and ChaCha20-Poly1305, the two AEAD ciphers you'll actually encounter in the wild (they're also the only cipher family TLS 1.3 permits, which you'll see again in the TLS project later in this roadmap). Everything here uses Python's cryptography library, the de facto standard binding to OpenSSL for Python.