Symmetric, Asymmetric, and Key Exchange
Unit 2: Change Management and Cryptography. Lesson 6 of 54 in SecPlus Academy.
Encryption turns readable data into unreadable data with a key, and back again with the right key. There are two families, and real systems use both together.
Symmetric encryption
One secret key both encrypts and decrypts. It is fast, so it protects bulk data: files, disks, database contents, the body of a TLS session.
- AES is the standard, with 128, 192, or 256-bit keys. Longer keys are stronger and slightly slower.
- 3DES is legacy and slow. ChaCha20 is a fast modern stream cipher. Blowfish and Twofish are older block ciphers.
The problem: both sides need the same key, and sending it in the clear defeats the purpose.
Asymmetric encryption
A key pair: a public key anyone may have and a private key only the owner holds. What one encrypts, only the other decrypts.
- Encrypt with the recipient's public key; only their private key can decrypt. Confidentiality.
- Sign with your private key; anyone verifies with your public key. Authenticity and non-repudiation.
- RSA is the classic; ECC (elliptic curve) gives the same strength with much shorter keys, so it suits phones and IoT. DSA and ECDSA are signature algorithms.
Asymmetric math is slow, so it is used for small things: exchanging keys and signing hashes.
Key exchange and forward secrecy
Diffie-Hellman lets two parties agree on a shared secret over an open channel without ever sending the secret. ECDHE is the elliptic-curve, ephemeral version: a fresh key for every session. Ephemeral keys give perfect forward secrecy: stealing the server's long-term private key later does not decrypt past sessions.
How TLS combines them
- The server proves its identity with a certificate (asymmetric).
- Client and server agree on a session key (key exchange).
- All the data is encrypted with that session key (symmetric, fast).
Use TLS 1.2 or 1.3. SSL and TLS 1.0 and 1.1 are deprecated.
Choosing
- Bulk data at rest or in a session: symmetric, AES-256.
- Prove identity, sign, or move a key safely: asymmetric.
- Constrained devices: ECC.
- Longer key length and a modern algorithm beat a longer password every time.
Symmetric, Asymmetric, and Key Exchange, explained slowly
Locks with one key, and mailboxes with a slot
There are two kinds of encryption, and the best way to keep them straight is two physical objects.
A padlock with one key is symmetric encryption. Whoever has the key can lock and unlock. It is fast and simple, but you have to get the key to the other person somehow, and if you mail it, anyone who intercepts the envelope has it.
A mailbox with a slot is asymmetric encryption. Anyone can drop a letter in the slot (the public key), but only the owner has the key to the door (the private key). Nobody needs to exchange a secret in advance.
Symmetric: fast, for bulk data
AES the standard; 128, 192, or 256-bit keys; use AES-256 when in doubt ChaCha20 fast stream cipher, common on mobile and in TLS 3DES legacy, slow; replace it Blowfish, Twofish older block ciphers you may see named
Symmetric encryption protects disks, files, databases, and the actual data inside a TLS session. It is thousands of times faster than asymmetric. Its one weakness is key distribution: both sides must share the key without anyone else seeing it.
Asymmetric: slow, for identity and key delivery
Each party has a key pair. The rule that answers every exam question:
To keep it secret encrypt with the RECIPIENT'S PUBLIC key only their private key opens it To prove who sent it sign with your OWN PRIVATE key anyone checks with your public key
- RSA: the classic; needs 2048-bit or longer keys today.
- ECC (elliptic curve): the same strength with far shorter keys, so it is faster and suits phones and IoT devices. A 256-bit ECC key is roughly as strong as a 3072-bit RSA key.
- DSA and ECDSA: signature-only algorithms.
Key exchange: agreeing on a secret in public
Diffie-Hellman is a piece of math that lets two parties each contribute a value, exchange results openly, and both arrive at the same shared secret that an eavesdropper cannot compute. That shared secret becomes the symmetric session key. ECDHE is the elliptic-curve version with ephemeral keys: a brand new key for every session.
Ephemeral keys give perfect forward secrecy. If someone records your traffic today and steals the server's long-term private key next year, they still cannot decrypt today's sessions, because the session key was never derived from that long-term key.
How TLS puts it together
- The browser connects. The server sends its certificate, which contains its public key, signed by a CA (asymmetric proves identity).
- Browser and server run ECDHE to agree on a session key (key exchange).
- Everything after that is AES or ChaCha20 with the session key (symmetric, fast).
So "which is used to encrypt the web page content" is symmetric, and "which is used to authenticate the server" is asymmetric. Use TLS 1.2 or 1.3; 1.3 removed the weak options entirely.
Key length and algorithm choice
Longer keys resist brute force longer. Modern guidance: AES-128 is fine, AES-256 for high value; RSA 2048 minimum; ECC 256. Deprecated: DES, 3DES, RC4, MD5, SHA-1, SSL, TLS 1.0 and 1.1.
How the exam asks it
- "Encrypt a message so only Alice can read it." Alice's public key.
- "Bob wants to prove he wrote the document." Bob's private key.
- "Which is fastest for encrypting a large file?" Symmetric, AES.
- "Compromise of the server key must not expose past sessions." Perfect forward secrecy, ephemeral Diffie-Hellman.
- "Best algorithm for a low-power device." ECC.
What to memorize
- Symmetric: one key, fast, AES. Asymmetric: key pair, slow, RSA and ECC.
- Recipient's public key to encrypt; your private key to sign.
- Diffie-Hellman agrees on a key; ephemeral keys give forward secrecy.