Symmetric vs Asymmetric Encryption: Why We Need Both

1. Why Should You Care?

Here’s a puzzle: You want to send an encrypted message to someone you’ve never met, over an untrusted network where anyone can eavesdrop.

If you use AES, you both need the same key. But how do you share that key securely… without already having a secure channel?

This is the key distribution problem, and it haunted cryptographers for centuries. The solution—asymmetric encryption—fundamentally changed how secure communication works. But it came with trade-offs that mean we still need both approaches.

2. Definition

Symmetric Encryption: Both parties use the same key to encrypt and decrypt.

• Examples: AES, ChaCha20, 3DES
• Analogy: A physical lock where both parties have identical keys

Asymmetric Encryption: Each party has a key pair—a public key (shareable) and a private key (secret).

• Examples: RSA, ECC, ElGamal
• Analogy: A mailbox with a slot—anyone can drop mail in (public key), only the owner can retrieve it (private key)

3. The Fundamental Difference

Symmetric: Same Key, Same Problem

Alice                                    Bob
  │                                       │
  │  Key: 🔑                              │  Key: 🔑
  │                                       │
  ├──── Encrypt(message, 🔑) ────────────►│
  │           ciphertext                  │
  │                                       ├── Decrypt(ciphertext, 🔑)
  │                                       │        = message

The Problem: How did Alice and Bob both get the key 🔑?

• Meet in person? Doesn’t scale.
• Send it over the network? Eve intercepts it.
• Use another encrypted channel? You need a key for that too.

Asymmetric: Different Keys, Different Roles

Alice                                    Bob
  │                                       │
  │  Has: Bob's Public Key 📬             │  Has: Private Key 🔐
  │                                       │       Public Key 📬
  │                                       │
  ├──── Encrypt(message, 📬) ────────────►│
  │           ciphertext                  │
  │                                       ├── Decrypt(ciphertext, 🔐)
  │                                       │        = message

The Solution: Bob publishes his public key 📬 openly. Eve can see it—that’s fine! Only Bob’s private key 🔐 can decrypt messages encrypted with 📬.

4. Performance: The Elephant in the Room

Asymmetric encryption solves key distribution but introduces a massive performance penalty.

Why is asymmetric so slow?

Symmetric encryption uses simple operations: XOR, bit shifts, substitution tables.

Asymmetric encryption uses complex mathematical operations: modular exponentiation with huge numbers (RSA) or elliptic curve point multiplication (ECC).

# Symmetric: Simple operations repeated
for round in range(10):
    state = substitute(state)
    state = shift_rows(state)
    state = mix_columns(state)
    state = add_round_key(state, key)

# Asymmetric: Heavy mathematical operations
ciphertext = (message ** public_exponent) % modulus
# Where modulus is a 2048-bit number!

5. Real Systems: Hybrid Encryption

Real-world systems don’t choose between symmetric and asymmetric—they use both.

The Hybrid Approach

┌─────────────────────────────────────────────────────────┐
│ 1. Key Exchange (Asymmetric)                           │
│    - Generate random symmetric key (session key)        │
│    - Encrypt session key with recipient's public key    │
│    - Send encrypted session key                         │
├─────────────────────────────────────────────────────────┤
│ 2. Data Transfer (Symmetric)                           │
│    - Encrypt actual data with session key (AES)         │
│    - Much faster for large amounts of data              │
└─────────────────────────────────────────────────────────┘

TLS Handshake Example

Client                                   Server
  │                                        │
  │ ──── ClientHello ─────────────────────►│
  │                                        │
  │ ◄──── ServerHello + Certificate ────── │
  │       (Contains server public key)     │
  │                                        │
  │ ──── Key Exchange ────────────────────►│
  │      (Encrypted with server public key)│
  │                                        │
  │ ◄════ Encrypted Data (AES-GCM) ═══════►│
  │       (Using derived session keys)     │

Why this works:

1. Asymmetric encryption is used only once (or a few times) for key exchange
2. Symmetric encryption handles the bulk data transfer
3. You get the best of both worlds: secure key distribution + fast data encryption

6. The Key Distribution Problem Solved

Before Asymmetric Cryptography (Pre-1976)

To communicate securely with N people:
- You need N different symmetric keys
- Each key must be exchanged securely (in person, trusted courier)
- Key management scales as O(N²) for a network

10 people = 45 key pairs needed
100 people = 4,950 key pairs needed
1,000 people = 499,500 key pairs needed

After Asymmetric Cryptography

To communicate securely with N people:
- Each person has ONE key pair
- Public keys can be distributed openly
- Key management scales as O(N)

10 people = 10 key pairs
100 people = 100 key pairs
1,000 people = 1,000 key pairs

7. When to Use Which

Use Symmetric Encryption When:

• Both parties already share a secret
• Encrypting data at rest (files, databases)
• High performance is required
• You control both ends of the communication

Use Asymmetric Encryption When:

• Parties have never communicated before
• You need digital signatures (non-repudiation)
• Distributing session keys
• Verifying identities (certificates)

Use Hybrid When:

• Secure communication over untrusted networks
• Encrypting large amounts of data for others
• Building any real-world secure communication system

8. Common Misconceptions

Security Level Equivalence

This is why ECC is popular—it achieves the same security as RSA with much smaller keys.

9. Code Example: Hybrid Encryption

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

def hybrid_encrypt(plaintext: bytes, recipient_public_key) -> dict:
    # 1. Generate random AES key (symmetric)
    aes_key = AESGCM.generate_key(bit_length=256)

    # 2. Encrypt data with AES (fast)
    nonce = os.urandom(12)
    aesgcm = AESGCM(aes_key)
    ciphertext = aesgcm.encrypt(nonce, plaintext, None)

    # 3. Encrypt AES key with RSA (asymmetric)
    encrypted_key = recipient_public_key.encrypt(
        aes_key,
        padding.OAEP(
            mgf=padding.MGF1(algorithm=hashes.SHA256()),
            algorithm=hashes.SHA256(),
            label=None
        )
    )

    return {
        'encrypted_key': encrypted_key,
        'nonce': nonce,
        'ciphertext': ciphertext
    }

def hybrid_decrypt(encrypted_data: dict, private_key) -> bytes:
    # 1. Decrypt AES key with RSA
    aes_key = private_key.decrypt(
        encrypted_data['encrypted_key'],
        padding.OAEP(
            mgf=padding.MGF1(algorithm=hashes.SHA256()),
            algorithm=hashes.SHA256(),
            label=None
        )
    )

    # 2. Decrypt data with AES
    aesgcm = AESGCM(aes_key)
    plaintext = aesgcm.decrypt(
        encrypted_data['nonce'],
        encrypted_data['ciphertext'],
        None
    )

    return plaintext

10. Summary

Three things to remember:

1. Symmetric is fast, asymmetric solves key distribution. Use symmetric for bulk data, asymmetric for key exchange. Real systems use both.

2. The hybrid approach is standard. TLS, PGP, and virtually all secure communication protocols use asymmetric crypto to exchange symmetric keys.

3. Key sizes are not comparable across types. AES-256 provides roughly equivalent security to RSA-15360 or ECC-512. This is why ECC is gaining popularity—smaller keys, same security.

11. What’s Next

We’ve mentioned hashing several times without fully explaining it. Is hashing encryption? (Spoiler: No.)

In the next article, we’ll explore: What hash functions actually do, why they’re not encryption, and the correct way to store passwords.