Encrypt and decrypt

Encryption: confidentiality

Encryption is the only one of the four that hides the content. Symmetric encryption such as AES uses one key both to encrypt and to decrypt:

openssl enc -aes-256-cbc -pbkdf2 -salt -a -pass pass:hunter2 -in config.txt -out config.enc
openssl enc -d -aes-256-cbc -pbkdf2 -a -pass pass:hunter2 -in config.enc

• -pbkdf2 derives the key from the password with a slow, salted KDF. Without it, OpenSSL uses a weak legacy derivation.
• -salt adds random salt, so encrypting the same file twice gives different ciphertext. The output starts with Salted__, which is U2FsdGVkX1… in base64.
• -a writes base64 text instead of raw binary.

Plain AES-CBC protects confidentiality but not integrity: someone can flip bits in the ciphertext without the key. Real protocols like TLS 1.3 use authenticated encryption (AES-GCM, ChaCha20-Poly1305), which detects tampering as well. You'll see those cipher suites in the TLS module.