I was researching on internet security. When I reached at section Cookies, I happened to read that the values inside a cookie are generally stored only after encrypting them. But an encryption can be easily decrypted by someone who can tamper the cookies. Considering the fact that if we have tampered the cookie, then whether it is encrypted or not, it is possible to access the session corresponding to that cookie. Then what is actually the purpose of encrypting the cookie?
If the encryption key is stored on the server, then only the server can decrypt the cookie, and only the server can make predictable changes to the cookie. An attacker can make changes to the cyphertext of the cookie, but they cannot know in advance what effect those changes will have. If the cookie additionally includes a message authentication code or other anti-tampering measure, then an attacker cannot make changes to an encrypted cookie without invalidating it.
Encrypting the cookie also keeps the user and others on the same computer from being able to see what information is being stored. This permits the server to associate sensitive information with a user (eg. "log me in automatically" information), without needing to track the session server-side.
Cookie encryption does nothing to keep cookie-stealing attacks from being used to impersonate a user; to defend against that, other measures are needed.
Cookies can be used for a variety of reasons. At the simplest level it might contain a random number that advises the site that you are the same person that visited previously, either for tracking purposes or to provide enhanced functionality such as user preferences. Such cookies do not need to be encrypted.
Encrypted cookies are used when you want to persist something client side that do you do not want changed and/or seen by a user. For example on the completion of an authentication process you will set an encrypted cookie containing details of the user to be presented with each subsequent request. This is what provides the appearance of a 'logged on session' when in fact the browser is making a series of otherwise unrelated atomic requests. In most large web sites this authenticated session management is handled by front end infrastructure services that hide this complexity from the application developer.
The cookie can also be used to contain current application state, which is useful if you application runs across multiple geographic sites and the user is expected to return to a another site before you have had a chance to replicate data there.
As to your last point, if you tamper with encrypted data you will almost always render it useless for the purpose for which it was intended. Depending on the application, it will either cause the server side application to fail, or fail validation of the encrypted data.