How Encryption Works and What a VPN Has to Do with It

We continue Cybersecurity Month — today, October 21, we mark World Encryption Day. It’s run by the GEC, which champions the protection of information.

As developers of privacy tools, we’re joining the celebration. We explain how data encryption works, how it’s implemented in our services, what VPNs have to do with it at all, and what lies ahead for information protection.

We’re giving out birthday gifts — visit our site all through October and win prizes!

What Is Encryption?

Encryption is the changing of data so that outsiders — providers, fraudsters, or censors — can’t read it. An important clarification: it doesn’t protect against interception, but it gives you confidence that attackers won’t understand the message.

Here’s a clear example — you can easily read this message, but you’re unlikely to guess what’s encrypted in it:
U2FsdGVkX1+NcL4nNGpMArfh/ITN/n8cWrHSJgGaIroWtD5lK8M10XPSiF9QXOnM

To make the task easier, we’ll share the key to the cipher: mySecretKey123.

How Does Encryption Work?

Everything is built around two elements: a cryptographic algorithm and a key.

A cryptographic algorithm is the instruction by which we’ll encrypt the information.
A cryptographic key is the secret constant we’ll apply within the algorithm.

It’s easier to explain with the Caesar cipher, the simplest cipher in the world. In it, each letter in a phrase shifts by a set number of positions. The shifting process itself is the algorithm, and the number of positions is the key.

Reconstruct the phrase using a Caesar cipher with a key of 13:

IRAV IVQV IVPV

With the Caesar cipher, picking the key is relatively easy even if you don’t know the algorithm. For the Latin alphabet, you have 25 shift options (excluding the original text).

That’s why the authors of cryptographic algorithms follow the principle that “the system should not require secrecy” and make their work publicly available. The reliability of encryption, meanwhile, is ensured by keys — even if they’re stolen, you can issue new ones.

Types of Encryption Algorithms and Keys

Encryption algorithms fall into two types:

Symmetric. For encryption and decryption we use a single private key, known only to the participants in the conversation. Notable examples: AES and ChaCha20.

Before asymmetric algorithms were invented, the main problem was distributing keys among participants. It was solved through physical exchange or centralized issuance. This made encryption expensive, poorly scalable, and vulnerable to being cracked. Everything changed in 1976 with the Diffie–Hellman asymmetric method for key exchange.
Asymmetric. These use an open public key for encryption and a closed private one for decryption. The Diffie–Hellman method lets two parties create public keys for encryption and then use private ones to decrypt the message.

The first asymmetric encryption algorithm, RSA, is based on multiplying pairs of large prime numbers. You give out one of them as a public key for encryption, and keep the second — for decryption — secret.

To crack modern versions of asymmetric algorithms, RSA-2048 included, you have to factor enormous numbers. As of publication, such scenarios lie in the realm of quantum computers — more on them a bit later — but are still closer to science fiction.

Key length, however, is only part of the protection. Rather than the algorithm, it’s easier for attackers to go after the platform itself or someone who has admin-level access to it. For instance, when Telegram was ordered to hand over its encryption keys under the “Yarovaya law” in 2017, what law enforcement wanted was precisely the private keys for decrypting your messages.

Symmetric and asymmetric encryption algorithms

Asymmetric algorithms rest on the difficulty of a specific mathematical problem, so at the same length the key gives less strength than a symmetric one. To solve this problem, asymmetric algorithms use more bits. For example, according to the U.S. NIST, RSA-3072 is as resistant as AES-128.

At the same time, symmetric encryption works faster and protects large volumes of critical data — banking information, for example. Asymmetric encryption is used where an exchange of public keys is needed — for example, to encrypt online correspondence.

Encryption in a VPN

A VPN protects users’ privacy online. Encryption plays a key role here — it hides the transmitted data from internet providers and attackers on the stretch between you and the VPN server. This makes MITM attacks pointless in terms of access to the transmitted information.

Some VPN protocols rely on TLS or its modifications — that’s how OpenVPN and VLESS (in combination with TLS or Reality masking) are built. But not all: WireGuard and AmneziaWG, for example, rely on the Noise_IK, Curve25519, and AEAD ChaCha20-Poly1305 protocols.

Where TLS is used, the traffic is encrypted with a symmetric algorithm — most often AES-256, which is considered resistant as of publication.

Encryption on its own, however, doesn’t guarantee bypassing blocking. Censors’ equipment looks out for the signatures of VPN protocols and then simply drops the connection. That’s exactly why services that specialize in fighting blocking additionally disguise themselves as legitimate traffic.

A VPN service creates a tunnel between your device and the VPN server, so the data is encrypted on its way to the latter. At the “transfer point,” it leaves the tunnel so the server can send it on to the target site. At that moment, only metadata is available to the server — the IP address, the volume and timing of the traffic, and the domain name. If you sent the request through HTTPS in the first place, your data is encrypted.

At Amnezia VPN, we deliberately limit our own access to the data you transmit. The no-logs model makes intercepting data impossible — it’s processed in the server’s RAM and isn’t stored on it.

It’s worth clarifying that we encrypt traffic only up to our servers in the locations you connect to. Beyond that, standard technologies like HTTPS handle the task.

That said, you can go even further in protecting your data — spin up your own self-hosted server based on Amnezia Hosting and route all your traffic through it.

The Future of Encryption

Many algorithms that seemed “unbreakable” — the Vigenère cipher, the World War II “Enigma,” the Hill cipher — turned out to be vulnerable to growing computing power. Even earlier versions of RSA, which we discussed above, based on fewer than 512 bits, can be cracked.

Over the past few years, the problem has been compounded by the development of quantum computers. Without going into detail, they speed up the cracking of symmetric algorithms with a small number of bits. Asymmetric approaches, under the influence of quantum computers, turn into a pumpkin altogether: quantum computers are very good at solving the problems these algorithms are built on.

But don’t despair! As of publication, quantum computers haven’t defeated a single algorithm and can barely solve problems with two-digit numbers. And although the power needed for cracking drops every year, the number of machines suitable for these tasks is somewhere around a hundred.

The ubiquitous AES-256 is resistant enough to attacks using quantum computers. It may well be protecting your connection to this page

One threat is the “harvest now, decrypt later” approach. Under it, governments and attackers collect all available traffic in order to later reconstruct its contents with the help of advanced quantum computers.

Still, researchers have thought of everything here too: they’ve proposed new algorithms for the transition to post-quantum cryptography.

We at Amnezia believe that the main problem in the context of encryption is initiatives like Europe’s Chat Control. They don’t threaten to crack the algorithms, but they fundamentally negate the very concept of encryption. Messengers and social networks are required to scan your correspondence to look for illegal material, and in that case encryption between the people talking no longer matters — the authorities will see the contents of your chats anyway.

In other words, officials are scarier than quantum computers.