ToolHub
Security · 10 min read · Updated 2026
安全 · 阅读约 10 分钟 · 更新于 2026

A Beginner's Guide to Encryption

加密入门

Encryption is the practice of scrambling a message so that only someone with the right key can unscramble it. The word covers a sprawl of techniques, from the Caesar cipher that Roman generals scribbled on papyrus to the mathematical constructions that protect your bank login today. Once you know the basic vocabulary — encoding vs hashing vs encryption, symmetric vs asymmetric, what TLS actually does — the rest of the field becomes much easier to read about, and much harder to mislead you with marketing.

加密就是把一段消息"打乱"，让只有拥有正确密钥的人能"还原"。这个词涵盖的技术面非常广，从罗马将领写在莎草纸上的凯撒密码，到今天保护你银行登录的数学构造。掌握基本词汇 —— 编码、哈希、加密的区别；对称与非对称；TLS 到底做了什么 —— 之后，再看相关材料会轻松得多，也更难被营销话术带偏。

The basic vocabulary: encoding, hashing, encryption, and the two main families

基本词汇：编码、哈希、加密，以及两大算法家族

Three terms are often used interchangeably in casual writing, but they are not the same. Encoding is a public, reversible way to represent data. Base64, URL-encoding, and UTF-8 are encodings. Anyone can decode them, with no secret. Encodings are designed to make data survive a transport layer that does not support all byte values — not to keep secrets. Hashing is a one-way function. Given an input, you can compute the hash quickly, but you cannot go back. Hashes are used for fingerprints (file integrity, commit IDs) and for storing passwords. Encryption is a two-way function that requires a key. With the right key, anyone holding the ciphertext can recover the original message; without the key, the ciphertext looks like random noise. A useful test: if the operation needs a secret to reverse, it is encryption. If it does not, it is encoding or hashing. Base64 is not encryption, SHA-256 is not encryption, and "we encrypted your password with Base64" is a sentence that betrays a misunderstanding of every word in it.

这三个词在日常文字里经常被混用，但其实不是同一回事。编码 是一种公开、可逆的数据表示方式。Base64、URL 编码、UTF-8 都是编码。任何人无需密钥就能解码，编码是为了让数据在"不支持全部字节值"的传输层中存活，不是为了保密。哈希 是单向函数：给定输入可以快速算出哈希，但无法反向。哈希用于指纹（文件完整性、提交 ID）和密码存储。加密 是需要密钥的双向函数：有正确密钥的人能从密文恢复原文；没有密钥，密文看起来就是一堆随机数。一个有用的判断方法：操作要"秘密"才能反向，就是加密；不需要，就是编码或哈希。Base64 不是加密，SHA-256 也不是加密。"我们用 Base64 加密了你的密码"这句话，每个词都透露出对概念的误解。

Encryption algorithms come in two broad families. Symmetric encryption uses the same secret key for both encryption and decryption. AES (the Advanced Encryption Standard, adopted by NIST in 2001) is the workhorse of this family. AES-128 and AES-256 are the two most common variants — both are believed to be secure against classical computers. ChaCha20 is a popular alternative designed by Daniel J. Bernstein; it is faster than AES on devices without hardware acceleration and is what TLS 1.3 uses when AES-NI is not available. The catch with symmetric encryption is the key-distribution problem: if Alice and Bob want to talk, they both need the same key, and somehow that key has to be transported to both of them without being intercepted.

加密算法大致分为两大类。对称加密 使用同一把密钥完成加密和解密。AES（高级加密标准，2001 年被 NIST 采纳）是这个家族的绝对主力。AES-128 与 AES-256 是最常见的两种变体 —— 在经典计算机面前都被认为是安全的。ChaCha20 是 Daniel J. Bernstein 设计的流行替代算法，在没有硬件加速的设备上比 AES 更快，是 TLS 1.3 在没有 AES-NI 时的首选。对称加密的难题是"密钥分发"：Alice 和 Bob 想要通信，就必须拥有同一把密钥，而那把密钥要以不被截获的方式送到双方手里。

Asymmetric encryption (also called public-key cryptography) solves this with a pair of mathematically linked keys: a public key that anyone can use to encrypt, and a private key that only the owner can use to decrypt. RSA (1977) and elliptic-curve cryptography (ECC, 1985) are the two main families. The breakthrough was the realization that some mathematical operations are easy to do in one direction and infeasible in the other, and that the infeasibility can be made to depend on a secret. The math is real but somewhat magical: multiplying two large primes is trivial, but factoring the product back into the primes is so hard that even the world's best supercomputers cannot do it for keys above a certain size. RSA's security rests on this asymmetry. ECC rests on a similar asymmetry: adding two points on an elliptic curve is easy, but finding the original point given only the sum is computationally infeasible.

非对称加密（也称公钥密码学）用一对数学上关联的密钥解决了分发难题：公钥可分发给任何人用于加密，私钥只有本人持有用于解密。RSA（1977 年）和椭圆曲线密码学（ECC，1985 年）是两大主流。这一突破的精髓在于：某些数学运算"正向容易反向几乎不可能"，并且可以让"不可逆"依赖某个秘密。数学是真的，但有点"魔法"：两个大素数相乘轻而易举，但把乘积再分解回两个素数却难到即使全球最强超算也无能为力（前提是密钥足够长）。RSA 的安全性就建立在这个不对称上。ECC 的不对称类似：椭圆曲线上两个点相加很容易，但只给定结果点求原"加数"在计算上不可行。

The public-key breakthrough and the key exchange

公钥突破与密钥交换

The first major public-key scheme was the Diffie–Hellman key exchange, published in 1976 by Whitfield Diffie and Martin Hellman. It solves a beautifully specific problem: two people who have never met and have no shared secret want to derive a shared key over an insecure channel, with an eavesdropper listening in. The protocol works by each side picking a secret, exchanging a "half-combined" value, and then combining again to reach the same final key. The eavesdropper, who only saw the half-combined values, cannot reconstruct the final key without solving the discrete logarithm problem.

第一个重要的公钥方案是 1976 年 Whitfield Diffie 和 Martin Hellman 发表的 Diffie–Hellman 密钥交换。它解决了一个非常具体的问题：两个从未谋面、也没有共享秘密的人，希望在不安全的信道上协商出一把共享密钥，而窃听者在一旁监听。协议的做法是：双方各选一个秘密，交换"半合成"的中间值，再各自做第二次合成得到完全相同的最终密钥。窃听者只看到中间值，没有解决"离散对数问题"的能力就无法还原出最终密钥。

RSA followed in 1977 (and was independently discovered earlier at GCHQ, classified at the time). It can be used both for key exchange — by encrypting a randomly chosen symmetric key with the recipient's public key — and for digital signatures — by signing a hash of a message with the sender's private key. RSA signatures underpin the entire SSL/TLS certificate system: when your browser loads a website, the certificate it checks is a signature chain that ends at a root key shipped with the operating system.

RSA 在 1977 年问世（实际上 GCHQ 更早独立发现，但当时保密）。它既可用于密钥交换 —— 用接收方公钥加密一把随机生成的对称密钥 —— 也可用于数字签名 —— 用发送方私钥对消息哈希做签名。RSA 签名是整个 SSL/TLS 证书体系的根基：浏览器访问网站时检查的证书是一条签名链，链尾是操作系统内置的根密钥。

A note on keys and security levels. In 2026, RSA is considered safe at 2048 bits and above; 1024-bit RSA was broken in practice years ago. ECC keys can be much shorter — 256-bit ECC provides roughly the same security as a 3072-bit RSA key. Most modern systems prefer ECC for this reason, but RSA is still widespread for compatibility.

关于密钥强度：2026 年普遍认为 2048 位及以上的 RSA 是安全的；1024 位 RSA 实际上早已被攻破。ECC 密钥可以短得多 —— 256 位 ECC 大致相当于 3072 位 RSA 的安全强度。现代系统大多因这个原因偏好 ECC，但 RSA 因兼容性原因仍被广泛使用。

How TLS uses both kinds of encryption

TLS 如何同时使用两类加密

Every time you see the padlock in your browser's address bar, TLS (Transport Layer Security) is running a short, carefully choreographed dance between asymmetric and symmetric cryptography. The latest version is TLS 1.3 (RFC 8446, 2018), which strips the handshake down to one round trip and removes a long list of legacy ciphers.

每次你在浏览器地址栏里看到小锁图标，TLS（传输层安全协议）都在运行一段精心编排的"双人舞"：非对称与对称密码学交替出场。最新的版本是 TLS 1.3（RFC 8446，2018 年），把握手精简到一次往返，并移除了大量历史遗留算法。

A simplified TLS 1.3 handshake looks like this:

简化的 TLS 1.3 握手流程如下：

  1. The client sends a "ClientHello" listing the cipher suites and key-share groups it supports (for example, X25519 for Diffie–Hellman, AES-256-GCM or ChaCha20-Poly1305 for bulk encryption).
  2. 客户端发送 ClientHello，列出支持的算法套件和密钥共享组（例如 X25519 用于 Diffie–Hellman，AES-256-GCM 或 ChaCha20-Poly1305 用于批量加密）。
  3. The server replies with its certificate, a chosen set of parameters, and its own key share. The certificate is verified against a chain of trust rooted in the operating system or browser.
  4. 服务器回复自己的证书、一组选定的参数以及它的密钥共享。证书通过操作系统或浏览器内置的根证书链进行验证。
  5. Both sides perform a Diffie–Hellman key exchange to derive a fresh session key, even if the server's certificate uses RSA. This is the "ephemeral" part — the key is new for every connection, so even if a future attacker breaks one session, every other session is still safe.
  6. 双方执行 Diffie–Hellman 密钥交换，得到一把全新会话密钥，即便服务器证书用的是 RSA。这正是"临时性"（ephemeral）的精髓 —— 每条连接的新密钥都是独立的，未来即使某次会话被攻破，其他会话仍然安全。
  7. From that point on, all application data — your HTTP request, the page content, the JSON for an API call — is encrypted with AES-256-GCM or ChaCha20-Poly1305, which is far faster than any public-key operation.
  8. 此后所有应用数据 —— 你的 HTTP 请求、网页内容、API 调用的 JSON —— 全部用 AES-256-GCM 或 ChaCha20-Poly1305 加密，这比任何公钥运算都快得多。

The asymmetric cryptography is used only at the start, to agree on a key without leaking it. The symmetric cryptography is used for everything else, because it is orders of magnitude faster. This hybrid is one of the most important design patterns in modern security: do the slow public-key work once, then enjoy the speed of symmetric crypto for the rest of the session.

非对称密码学只在最开始使用，用来在"不泄露密钥"的前提下协商出会话密钥；对称密码学负责后续所有数据，因为后者比前者快几个数量级。这种"混合"是现代安全最重要的设计模式之一：把慢的公钥工作只做一次，余下的会话用高速的对称加密。

End-to-end encryption: PGP, GPG, and the Signal protocol

端到端加密：PGP、GPG 与 Signal 协议

Email was not designed with encryption in mind, and the standard protocol (SMTP) sends messages in plaintext across many hops. PGP (Pretty Good Privacy), invented by Phil Zimmermann in 1991, was the first widely used system to bring strong end-to-end encryption to email. The open-source implementation is GPG (GNU Privacy Guard), and the on-the-wire format is OpenPGP. PGP uses a hybrid scheme similar to TLS: the body of the message is encrypted with a one-time symmetric key, and that key is then encrypted with the recipient's public key. To verify the message was not tampered with, the sender signs it with their private key. Public keys are published on "key servers" or shared directly, and a "web of trust" — users signing each other's keys — historically stood in for the centralized certificate authorities used in TLS. In practice, PGP is hard to use well: key management is brittle, the web of trust is uneven, and metadata (sender, recipient, subject line) is still plaintext.

电子邮件在设计时就没考虑加密，标准协议（SMTP）让消息在多个中转节点间以明文传递。1991 年 Phil Zimmermann 发明的 PGP（Pretty Good Privacy）是把"端到端强加密"带入邮件的第一套被广泛使用的系统。它的开源实现是 GPG（GNU Privacy Guard），传输格式是 OpenPGP。PGP 使用的也是类似 TLS 的混合方案：邮件正文用一次性对称密钥加密，再用收件人公钥加密这把密钥；为防止篡改，发件人会用自己私钥对消息做签名。公钥发布在"密钥服务器"或直接交换，历史上用"信任网络"（用户互相签名）替代 TLS 的集中式证书机构。实际使用中，PGP 很难"用对"：密钥管理脆弱、信任网络不均衡、元数据（发件人、收件人、主题行）仍以明文传输。

The Signal protocol, used by Signal, WhatsApp, Facebook Messenger's "secret conversations", and Google Messages' RCS, is the gold standard for end-to-end encrypted messaging in 2026. It combines two key ideas: the Double Ratchet, which generates a new encryption key for every single message, and X3DH, an authenticated key exchange that bootstraps a session from long-term identity keys and one-time prekeys. The "ratchet" part refers to a one-way function that updates the key state in a way that cannot be reversed. After every message, both sides advance the ratchet, so even if a future key is somehow exposed, the previous messages remain secure — a property called forward secrecy, and the main reason modern messaging has outpaced PGP. Signal also introduces post-compromise security: even after a key is exposed, the protocol can heal itself after a few round-trips. The combination of forward secrecy (past) and post-compromise security (future) is what the industry calls "self-healing" cryptography. For most people, end-to-end encrypted messaging apps have replaced PGP for day-to-day communication; PGP remains useful for signing software releases and for journalists and activists who need to authenticate long-term contacts.

Signal 协议是 2026 年端到端加密通讯的"黄金标准"，被 Signal、WhatsApp、Facebook Messenger 的"密谈"、Google Messages 的 RCS 广泛采用。它融合两个关键思想：双棘轮算法（Double Ratchet）为每一条消息生成独立密钥；X3DH 是从长期身份密钥和一次性预共享密钥引导出会话的可认证密钥交换协议。"棘轮"指一种单向函数：推进状态后无法回退。每条消息之后双方都推进棘轮，因此即使未来某把密钥泄露，之前的消息仍然安全 —— 这一性质称为前向保密，也是现代即时通讯超越 PGP 的主要原因。Signal 还引入了后向攻破安全：即使密钥被泄露，协议在几轮交互后能"自愈"。前向保密保护过去、后向攻破安全保护未来，两者合在一起就是业界所说的"自愈式"密码学。对大多数人来说，端到端加密的即时通讯应用已替代 PGP 用于日常通信；PGP 仍用于软件发布签名，以及需要长期验证身份的记者和活动人士。

Practical encryption: passwords, keys, and marketing

实操要点：口令、密钥与营销话术

There is a sharp difference between two practical models. Key-based encryption uses a high-entropy random key — 32 random bytes from a cryptographic RNG. Such a key is computationally infeasible to guess, and it is the right choice whenever the key can be stored somewhere safe (a TPM, a key management service, a smart card). Password-based encryption uses a human-memorable passphrase as the starting point. Because a passphrase has far less entropy than a random key, the encryption must work much harder to compensate. The standard technique is a password-based key derivation function such as Argon2id, scrypt, or PBKDF2, which deliberately spends a few hundred milliseconds of CPU time to turn a low-entropy passphrase into a high-entropy key. In practice, almost every "encrypt this file" tool you encounter — 7-Zip with AES-256, BitLocker, FileVault, LUKS, GPG symmetric — uses password-based encryption, because the user has to unlock it without carrying a key file. The safety of that system depends entirely on the strength of the passphrase and the work factor of the KDF.

两种实操模型之间有本质区别。基于密钥的加密 使用高熵随机密钥 —— 来自密码学随机数生成器的 32 字节随机数。这种密钥在计算上不可被猜中，是密钥可以存放在安全地方（TPM、密钥管理服务、智能卡）时的正确选择。基于口令的加密 以人类能记住的口令短语为起点。由于口令短语的熵远低于随机密钥，加密过程必须"加倍努力"来弥补。标准技术是口令派生密钥函数，例如 Argon2id、scrypt 或 PBKDF2 —— 它们刻意花费几百毫秒的 CPU 时间，把低熵口令转换为高熵密钥。实际中你遇到的大多数"加密文件"工具 —— 7-Zip 的 AES-256、BitLocker、FileVault、LUKS、GPG 对称加密 —— 都使用口令加密，因为用户要在不携带密钥文件的前提下解锁它。这种系统的安全性完全取决于口令强度和 KDF 的工作因子。

"Military-grade encryption" is one of the most meaningless phrases in security marketing. AES-256 is approved by the NSA for top-secret data, so any product that uses AES-256 can technically call itself "military-grade" — including apps that store your contacts in a plaintext SQLite database on a public server. The cipher is the easy part. The hard parts are: how the keys are generated, where they are stored, who has access, how the implementation resists side-channel attacks, and what happens when the company's database gets breached. When evaluating a product, ignore "military-grade" and look for specifics: which algorithm, which key size, which mode of operation (GCM is the modern default, ECB is a red flag), which library, and whether the source code has been audited. "End-to-end" is another phrase that requires inspection: the keys must be generated on the user's device and never leave it, or the marketing claim is hollow.

"军用级加密"是安全营销里最没有信息量的词之一。AES-256 确实被 NSA 批准用于最高机密数据，因此任何使用 AES-256 的产品都可以自称"军用级" —— 包括那种把联系人存在公共服务器明文 SQLite 数据库里的应用。算法本身是容易的部分。难的部分是：密钥如何生成、存放在哪里、谁能访问、实现是否能抗侧信道攻击，以及公司数据库被攻破后会怎样。评估一个产品时，请忽略"军用级"，去看具体细节：用哪种算法、什么密钥长度、什么工作模式（GCM 是现代默认，ECB 是红旗）、哪个库、源代码是否经过审计。"端到端"也需要核实：密钥必须在用户设备上生成且永不离开，否则营销承诺就是空话。

Quantum computers and the post-quantum migration

量子计算机与后量子迁移

A sufficiently large quantum computer would break most of the public-key cryptography we use today. Peter Shor's 1994 algorithm can factor large numbers and compute discrete logarithms in polynomial time, which would render RSA, Diffie–Hellman, and ECC useless in one stroke. Symmetric ciphers like AES are weakened but not broken: Grover's algorithm halves the effective key length, so AES-128 becomes equivalent to a 64-bit key (insecure) while AES-256 remains strong.

足够大的量子计算机会破解我们今天使用的大多数公钥密码学。Peter Shor 1994 年的算法可以在多项式时间内完成大整数分解和离散对数计算，这意味着 RSA、Diffie–Hellman、ECC 会在一夜之间失效。对称算法如 AES 被削弱但未被攻破：Grover 算法把有效密钥长度减半，因此 AES-128 相当于 64 位（已不安全），而 AES-256 仍然稳健。

No one knows exactly when a cryptographically relevant quantum computer will arrive. The US National Institute of Standards and Technology started a public process in 2016 to standardize "post-quantum" algorithms, and in 2024 published the first three standards: ML-KEM (formerly Kyber) for key exchange, ML-DSA (formerly Dilithium) for digital signatures, and SLH-DSA (formerly SPHINCS+) as a hash-based signature backup. Major browsers, operating systems, and TLS libraries have already started deploying hybrid schemes that combine classical and post-quantum key exchange, so that a connection remains secure if either side is broken.

没人能准确预测"密码学相关"的量子计算机何时到来。NIST 在 2016 年启动了"后量子"算法的公开标准化流程，2024 年发布首批三项标准：用于密钥交换的 ML-KEM（原 Kyber）、用于数字签名的 ML-DSA（原 Dilithium），以及基于哈希的签名备份方案 SLH-DSA（原 SPHINCS+）。主流浏览器、操作系统和 TLS 库已开始部署"混合"方案，把经典与后量子密钥交换并行使用，这样无论哪一边被攻破，连接仍然安全。

The most dangerous part of the quantum threat is not the day the quantum computer arrives — it is the "harvest now, decrypt later" attack, in which an adversary records encrypted traffic today and decrypts it years later when the hardware is ready. Sensitive data with a long secrecy lifetime (medical records, diplomatic cables, source code) is at risk right now. If you run a system whose secrets need to remain secret for 10+ years, you should already be planning the migration to post-quantum primitives.

量子威胁最危险的部分不是量子计算机出现的那一天 —— 而是"先收割、后解密"攻击：对手现在录下加密流量，等硬件成熟后再解密。保密期长（病历、外交电报、源代码）的敏感数据此刻就处于风险之中。如果你运营的系统的秘密需要保密 10 年以上，现在就应该开始规划向后量子原语的迁移。

Try the tools

试试这些工具

Encode test data with the Base64 tool, generate a strong key to feed into an encryption tool with the password generator, and look at a JWT or other encoded token in the URL encoder. Everything runs in your browser, so your data never leaves your device.

用 Base64 工具 编解码测试数据；用 密码生成器 生成一把"够强"的密钥喂给加密工具；用 URL 编码器 查看 JWT 等编码后的 token。所有处理都在浏览器中完成，数据不会离开你的设备。