Encryption in transit and at rest
What TLS does and does not promise, what handshakes cost, which at-rest layer stops which attacker, and why an AES-GCM key has a usage limit.
25 min6 steps
By the end you can
- Explain what TLS guarantees, what it does not, and why internal traffic needs it too
- Estimate handshake load and the effect of session resumption
- Choose between disk, database and application-level encryption for a given threat
- Explain why authenticated encryption keys have usage limits and nonces must never repeat
What TLS promises
TLS 1.3 gives confidentiality, integrity, server authentication and, via ephemeral keys, forward secrecy. It ends at your server (logs, database see plaintext). HSTS stops http:// downgrade.
Inside the network too
"Behind the firewall" assumes no insider. Encrypt service traffic and use mutual TLS: both sides present certificates, so identity replaces IP trust.
What handshakes cost
A full handshake costs the server a certificate signature and the client a round trip. Resumption skips the signature; connection reuse skips the handshake.
Full handshake
- Server signs with its key
- One round trip
Resumption (PSK)
- No certificate signature
Reused connection
- No handshake at all
- Keep-alive, HTTP/2
Loading question…
Encryption at rest: which attacker?
Each layer stops a different attacker. More selective means more protective and more costly (encrypted fields are hard to search).
Disk / volume
- Stops stolen disk
- Running DB shows plaintext
Database (TDE)
- Stops copied files, backups
- Authorised connections see plaintext
Field-level
- Keys outside the DB
- SQL injection returns ciphertext
- No normal indexing
Keys wear out: the AES-GCM limit
AES-GCM needs a unique nonce per message. Reuse leaks plaintext XOR and the auth key. With random 96-bit IVs, NIST SP 800-38D caps a key at 2^32 encryptions. Rotate by usage, not just by calendar.
Max per key
2^32
≈ 4.3 billion
At 10,000 msg/s
≈ 5 days
4.29e9 / 1e4 s
Loading question…
Check your mastery
Score 80% or more.
Mastery check
4 questions on fresh variants. One attempt each, no time limit. Score 80% or more to master the lesson.
Next: key management and secrets.
Answer this step to continue.