Protecting Stored Data with Cryptography

5.3

Unit 5 · Securing Applications and Data

Even if attackers reach your files, encryption keeps the contents unreadable. Step into the crypto vault lab and learn to scramble — and recover — stored data.

Welcome to the AgriNova Crypto Vault Lab. The farm stores customer records, payroll, and crop data in files. Access controls help, but what if an attacker copies a file anyway? Encryption is the last line of defense: it transforms readable data into scrambled data that's useless without the right key.

Encryption converts plaintext (readable data) into ciphertext (scrambled data) using a key. Decryption reverses it. With symmetric encryption, the same secret key both locks and unlocks the data — which makes protecting that key the whole game.

Encrypt Stored Data

Turn plaintext into ciphertext so a stolen file reveals nothing readable.

Use a Symmetric Key

One shared secret key encrypts and decrypts. Speed and simplicity — if the key stays secret.

Guard the Key

Lose the key and you lose the data (availability risk). Leak it and the protection is gone.

AP Learning Objectives

1Explain how encryption protects files.
2Apply symmetric encryption algorithms to encrypt and decrypt data.

Scenario Setup — Protecting Stored Files

AgriNova keeps sensitive files on a shared drive. You'll encrypt them so that even a stolen copy is unreadable ciphertext, practice symmetric encrypt/decrypt with a toy cipher, and decide how to store the key safely — while learning the painful lesson of what happens when a key is lost. All on a safe, fictional system with a classroom cipher.

Big Idea

Encryption protects confidentiality of stored data — but the protection is only as strong as the secrecy of the key. Symmetric encryption is fast and simple, yet it shifts the entire risk onto one secret: keep it safe, keep it available.

What You Will Learn

You'll explain how encryption protects files, apply a symmetric algorithm to encrypt and decrypt data, reason about key secrecy, and weigh the availability risk of a lost key — the AP Mitigate Risk skill applied to stored data.

Core Concept

Plaintext, Ciphertext, and the Symmetric Key

How encryption transforms data, and why the same key both locks and unlocks it.

Encryption uses an algorithm and a key to transform data:

Plaintext: the original readable data (e.g., HARVEST PLAN).
Algorithm: the mathematical procedure that scrambles/unscrambles.
Key: the secret value that controls the transformation.
Ciphertext: the scrambled, unreadable output stored on disk.

In symmetric encryption, the same key is used to encrypt and decrypt. That's efficient — great for protecting large stored files — but it means anyone with the key can read the data, so the key must be kept secret and backed up safely.

Figure 1 — Encryption turns readable plaintext into stored ciphertext using an algorithm and a secret key.

How Encryption Protects a File Cause: the payroll file is encrypted before being saved. Effect if stolen: the attacker gets ciphertext — meaningless without the key — so confidentiality is preserved. Encryption doesn't stop the file from being copied; it makes the copy useless. That's why it's the last line of defense for stored data.

Figure 2 — Symmetric encryption uses the same secret key in both directions.

Lab 1

Stored File Encryption Simulator

Type a file's contents, then lock the vault. See how the stored data becomes unreadable ciphertext — and unlock it with the key.

On Disk

HARVEST PLAN 2026

Stored As

—

A stolen copy of an encrypted file is just ciphertext — useless without the key.

Key Vocabulary

Terms for MCQ and Data-Protection Analysis

Definitions you'll need for multiple choice and free-response answers.

Cryptography Vocabulary

Term	Definition	Vault Example
Encryption	Transforming readable data into unreadable form using a key.	Locking the payroll file.
Decryption	Reversing encryption to recover the original data.	Unlocking with the key.
Plaintext	The original, readable data.	`HARVEST PLAN`
Ciphertext	The scrambled, unreadable output.	`Kduyhvw Sodq`
Key	The secret value controlling encryption/decryption.	The vault combination.
Algorithm (cipher)	The procedure that performs the transformation.	The scrambling method.
Symmetric encryption	Same key used to encrypt and decrypt.	One shared secret key.
Key secrecy	Keeping the key known only to authorized parties.	Never email the key.
Availability risk	Risk that authorized users lose access to data.	Lost key = lost file.
Confidentiality	Keeping data secret from unauthorized parties.	What encryption protects.

Symmetric Encryption at a Glance

Property	What it means
Keys used	One shared secret key for both encrypt and decrypt.
Speed	Fast — well suited to encrypting large stored files.
Main strength	Protects confidentiality of stored data efficiently.
Main weakness	The key must be shared and kept secret; if it leaks, protection is lost.
Availability trap	If the only key is lost, the data can become permanently unreadable.

encryption decryption plaintext ciphertext symmetric key key secrecy availability risk confidentiality

AP Exam Focus

What the Exam Wants You to Explain

Skill in focus: Mitigate Risk — use encryption to reduce the risk to stored data, and reason about the key.

AP Skill Alignment — Mitigate Risk

A complete AP answer about encrypting stored data: (1) states what encryption does (plaintext → ciphertext with a key), (2) explains how that mitigates the risk (a stolen file is unreadable, protecting confidentiality), and (3) notes the trade-off — the key must stay secret and available, or you risk losing the data.

Common MCQ Traps

Confusing encryption (reversible with a key) with hashing (one-way).
Thinking encryption prevents theft — it makes stolen data unreadable, not un-stealable.
Forgetting that symmetric uses one key for both directions.
Ignoring the availability risk: lose the key and the data is gone.

Scenario Connection

If a stem says "sensitive files must stay confidential even if the drive is stolen," the expected mitigation is encrypting stored data. If it asks about the downside, name key management: a leaked key breaks confidentiality and a lost key destroys availability.

Analyst Note — Evidence Artifact

      [VAULT LOG] farm-fileserver (fictional)

      payroll.dat — status: ENCRYPTED (symmetric)

      incident: laptop with file copy STOLEN

      attacker view of file: 9c1f...e7 (ciphertext) — unreadable

      key store: backed up to secure key vault

Read it like AP wants: the file was stolen but encrypted, so the attacker only sees ciphertext — confidentiality mitigated by encryption. Because the key was backed up to a secure vault, the farm keeps availability too. Encryption + good key management = risk reduced on both sides.

Worked Example

Lab: Symmetric Encrypt & Decrypt

The flagship lab. Apply a symmetric algorithm by hand-of-the-machine: same key encrypts and decrypts, then read the AP-style reasoning.

Below is a classroom toy cipher (a simple letter-shift) used only to illustrate the symmetric idea — it is not secure and must never protect real data. Encrypt a message with a key, then decrypt the ciphertext with the same key to recover the plaintext. Try a wrong key to see why key secrecy matters.

Lab 2

Symmetric Key Encrypt/Decrypt Toy Lab

Enter a message and a numeric key (1–25). The same key encrypts and decrypts — that's symmetric encryption.

OutputEnter a message and key, then Encrypt or Decrypt.

Tip: encrypt with key 3, then decrypt the result with key 3 to get your message back. Decrypt with a different key and it stays scrambled.

Figure 3 — The key sits between two risks: leaking it breaks confidentiality; losing it breaks availability.

Lab 3

Key Handling Decision Lab

For each fictional situation, choose the safest key-handling action. Instant feedback explains the reasoning.

Decided: 0 / 4

AP-Style Reasoning Walkthrough

Prompt: "AgriNova must keep payroll files confidential even if a drive is stolen. Explain how symmetric encryption mitigates this risk and identify a trade-off."

Model answer: Encrypt the payroll file with a symmetric algorithm: the same secret key turns the plaintext into ciphertext before it's stored. If the drive is stolen, the attacker only obtains ciphertext, which is unreadable without the key — so confidentiality is preserved and the risk is mitigated.

Trade-off: the protection depends entirely on the key. If the key leaks, confidentiality is lost; if the key is lost, the data can't be decrypted — an availability risk. So the farm must keep the key secret and securely backed up.

Common Mistakes

Misconceptions That Cost AP Points

Recognize the wrong answer and you'll avoid writing it.

× "Encryption and hashing are the same."

Encryption is reversible with a key (you get the data back); hashing is one-way (you can't). Files you need to read again are encrypted, not hashed.

AP trap: "so it can be recovered later" points to encryption.

× "Encryption stops the file from being stolen."

It doesn't prevent copying — it makes the copy unreadable. It protects confidentiality, not possession.

AP trap: "prevents theft" — say "makes stolen data unreadable."

× "Symmetric encryption uses two different keys."

Symmetric uses the same key for both encrypt and decrypt. (Two-key systems are asymmetric.)

AP trap: "same secret key both ways" = symmetric.

× "Losing the key is no big deal."

If the only key is lost, the ciphertext can't be decrypted — the data is effectively destroyed. That's an availability risk.

AP trap: weigh availability, not just confidentiality.

× "A longer message means stronger encryption."

Strength comes from the algorithm and key secrecy/length, not the message length.

AP trap: focus on the key, not the plaintext size.

× "Once encrypted, the key can be stored anywhere."

A key left next to the data (or emailed) defeats the protection. Keys need their own secure, backed-up storage.

AP trap: key management is part of the answer.

Reference & Practice Tools

Crypto Reference + Practice Tools

A quick-reference table plus three hands-on tools: a control matcher, a lost-key simulator, and a misconception sorter.

Concept → Role → If It Fails

Concept	Role in protecting stored data	If it fails
Encryption	Turns plaintext into ciphertext.	Files readable if stolen.
Decryption	Recovers plaintext for authorized use.	No legitimate access.
Symmetric key	Locks & unlocks the same file.	—
Key secrecy	Keeps the key from attackers.	Leaked key → lost confidentiality.
Key availability	Ensures owners can still decrypt.	Lost key → lost data.

Lab 4

File Protection Control Matcher

Click a goal, then click the control that achieves it. Correct pairs turn green.

Encrypt stored data

Keep key secret

Keep key available

Limit who can decrypt

Matched: 0 / 8

Lab 5

Lost Key Consequence Simulator

An encrypted file sits in the vault. See what happens when you have the key, lose the key, or have a secure backup.

payroll.dat — encrypted (symmetric)

Key present — file can be decrypted normally.

Key management is the hidden half of encryption — secrecy and availability.

Lab 6

Encryption Misconception Sorter

Click each statement, then sort it as a Myth or a Fact. Correct placements turn green.

Myth

Fact

Sorted: 0 / 6

Practice & Wrap-Up

Mini AP Quiz + Takeaways

Five quick AP-style questions with instant feedback, then your snapshot for review.

Lab 7

Mini AP-Style Quiz

Choose the best answer. Explanations appear instantly; your score totals at the end.

5 Key Takeaways

1Encryption converts plaintext into ciphertext with a key, so stored data stays confidential even if stolen.
2Decryption reverses encryption to recover the original data for authorized users.
3Symmetric encryption uses the same secret key to encrypt and decrypt — fast and ideal for stored files.
4Key secrecy is everything: a leaked key removes all protection.
5A lost key is an availability risk — the data may be unrecoverable, so back keys up securely.

encryption decryption plaintext ciphertext symmetric key key secrecy availability risk confidentiality

Final AP Exam Tip

To "mitigate risk" with encryption, say what it does (plaintext → ciphertext with a key), how it helps (stolen file is unreadable → confidentiality), and the trade-off (key must stay secret and available). Cover both sides for full credit.

One Mistake to Avoid Don't say encryption "prevents theft." It doesn't stop copying — it makes the stolen copy unreadable. And never forget the lost-key availability risk.

Protecting Stored Data with Cryptography