What is the difference between AES encryption algorithm and secret key in crypto-js library?

Question

Recently while learning Backend development (Node, Express, MongoDB), I discovered the crypto-js library. According to the docs, we can use the following code to encrypt a message using the AES Encryption -

const ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString();

However, as I'm new to cryptography, the difference between an encryption algorithm and a secret key is not very clear to me.
I have a message, and I can use the AES encryption algorithm to encrypt/decrypt it. Same way, I can use the AES encryption algorithm to decrypt the message as well. Hence, I don't understand how does a secret key fit in here? How exactly do an encryption algorithm and a secret key work in tandem to secure a message?

I have gone through numerous videos, blogs, StackOverflow posts, etc. on the internet, however, I couldn't understand it completely through all the complex crypto jargon. I do have a faint idea, which I'll describe below with the help of Ceaser's cipher.

In Ceaser's Cipher, what I've understood is that the technique of shifting letters by a certain number (A shifted by 4 places is E) is the encryption algorithm, and the certain number (4) is the secret key.

Can somebody please tell me if I'm correct?

• If I'm correct, can you please tell me how exactly this translates in the case of the AES encryption mentioned in the beginning?

• If I'm not correct, can anyone explain this with the help of a simple analogy? Please try to minimize the use of crypto jargon, as otherwise I'll get lost again.

Answer 1

The algorithm is a series of steps that happen in processing the data with the secret key to produce the encrypted data.

There are two inputs into the algorithm - the key and the initial data. The algorithm takes those two inputs and produces the encrypted output.

+---------+  +---------+
|   Key   |  |   Data  |
+---------+  +---------+
    \            /
     \          /
      \        /
       \      /
        \    /
    +-----------+
    | Algorithm |
    +-----------+
          |
    +-----------+
    | Encrypted |
    | Result    |
    +-----------+
          

The key and the data are separate from the algorithm. If you change either of them, you will get a different encrypted result without changing the algorithm.

---

In your example of the very simple Caesar Cipher, the algorithm is that each character in the input is going to be replaced by another character (a substitution cipher) that is offset in the alphabet by some amount.

The key would be what the amount is. So, if the key is 1, then a is replaced by b and b is replaced by c and so on. The code for the algorithm can be written to accept the key as an input parameter or function argument and the algorithm code does not have to be rewritten for a different key. The key is applied to the input data by the algorithm programmatically to produced the result. The same algorithm code works with all the different keys you can pass it.

---

Can somebody please tell me if I'm correct [in understanding the algorithm and key in the Caesar Cipher]?

Yes, your understanding of that is correct.

If I'm correct, can you please tell me how exactly this translates in the case of the AES encryption mentioned in the beginning?

The AES encryption is a much more complicated algorithm that again accepts input data and a key. In this case, the key is a block of data itself, not just a single number. If you want to know more about how it works, you can find many articles on the web about it so it's probably better to read those than try to repeat all that here. Here's one article: What is AES Encryption and How Does It Work?.

Note, you generally do not need to know how a given encryption algorithm works in order to use it successfully. You do need to know how secure it is, what kind of keys are required, what kind of output it generates and how you decrypt it. But, you don't need to know the details of how the algorithm works. And, you need to select the right type of algorithm (for example, symmetric encryption with the same key used for encryption and description vs. asymmetric encryption such as public key/private key pairs) because this determines how you generate/manage/share secrets.

In your code example:

const ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString();

CryptoJS.AES.encrypt is a function that implements the algorithm. It accepts two arguments. The first argument is the data you want encrypted. The second argument is a key string where all the data in the key is used in the encryption and the key will need to be supplied again in order to descrypt the data.

The result of the call to CryptoJS.AES.encrypt() is a buffer of data.