Symmetric encryption, asymmetric encryption, key management and hybrid security

Cybersecurity Foundations Training Series

Learning objectives

• Explain plaintext, ciphertext, keys, algorithms, encryption and decryption.

• Compare symmetric and asymmetric cryptography.

• Describe how public and private keys support encryption and signatures.

• Explain why secure systems combine asymmetric and symmetric techniques.

What cryptography does

Cryptography uses mathematical techniques to protect information and communications. Depending on the mechanism, it supports confidentiality, integrity, authenticity and related security objectives.

Plaintext is readable input. An encryption algorithm processes the plaintext with a key and produces ciphertext. Decryption uses the required key and algorithm to recover the plaintext. The security of a modern design should depend on protecting the key rather than hiding the algorithm.

Symmetric encryption

Symmetric encryption uses the same secret key, or directly related secret key material, for encryption and decryption. It is efficient and well suited to protecting large volumes of data.

The main operational challenge is key distribution. Both parties need access to the secret key without exposing it to an attacker. Key generation, storage, rotation, backup, revocation and destruction are therefore essential parts of the security design.

The Advanced Encryption Standard, or AES, is a widely adopted symmetric block cipher. AES supports 128-bit, 192-bit and 256-bit keys. The selected algorithm, mode of operation, key management and implementation all affect security. A long key does not compensate for a weak mode, reused nonce, exposed key or vulnerable implementation.

Key length and security strength

For an ideal n-bit symmetric key, exhaustive search involves up to 2 raised to the power n possible keys. Increasing key length sharply increases the work required for brute-force search.

Real security cannot be judged by key length alone. Algorithm design, protocol use, random-number generation, key protection, side-channel resistance, software quality and operational controls remain important.

Asymmetric cryptography

Asymmetric cryptography uses a mathematically related key pair: a public key and a private key. The public key can be distributed. The private key must remain under the owner’s control.

For public-key encryption, a sender uses the recipient’s public key or an agreed public-key mechanism so that only the holder of the matching private key can recover the protected secret.

Digital signatures use the signer’s private key through a defined signature algorithm. Other parties use the public key to verify the signature. It is more accurate to describe signing as a signature operation, not as “encrypting with the private key”, because many signature schemes do not work as reversed encryption.

Figure 1. Public-key encryption protects information for the holder of the matching private key.

Asymmetric techniques

RSA supports encryption and digital signatures when used with approved padding and protocol designs.

Elliptic-curve cryptography supports key agreement and digital signatures with smaller key sizes than many older public-key approaches for comparable security levels.

Diffie-Hellman and elliptic-curve Diffie-Hellman establish a shared secret between parties. They provide key agreement rather than general file encryption by themselves.

Certificates and public key infrastructure bind public keys to identities and help relying parties decide whether to trust them.

Why secure systems use hybrid encryption

Asymmetric operations are computationally more expensive than symmetric encryption and are less suitable for protecting large data streams directly. Symmetric encryption is fast but requires a secure way to establish shared keys.

Modern protocols combine the strengths of both. Public-key methods authenticate endpoints and establish fresh session secrets. Symmetric authenticated encryption then protects the bulk data. TLS uses this general hybrid approach.

Session keys are short-lived and should be renewed or discarded according to the protocol and risk. Compromise of a long-term credential should not automatically expose every previous session when forward secrecy is properly implemented.

Figure 2. Secure protocols combine public-key trust and key establishment with fast symmetric protection.

Comparing symmetric and asymmetric cryptography

Standards and framework alignment

This lesson uses the following frameworks as complementary references. NIST provides risk and control guidance, ISO/IEC 27001 defines requirements for an information security management system, ISO 22301 addresses business continuity, and SOC 2 evaluates service-organisation controls against the AICPA Trust Services Criteria.