Symmetric and Asymmetric Encryption

Encryption transforms readable plaintext into unreadable ciphertext using an algorithm and a key. Decryption reverses the process — but only with the correct key.

What encryption does:

• Makes intercepted data unreadable.
• Provides CONFIDENTIALITY.
• (With asymmetric methods) provides AUTHENTICATION via digital signatures.

What encryption doesn't do:

• Prevent interception itself — packets can still be captured.
• Compress the data (compression is a separate operation).
• Detect transmission errors (that's what error-detection codes do).
• Authenticate by itself (you need digital signatures, which use asymmetric encryption).

Two families:

Family	Keys	Speed	Distribution problem
Symmetric	One shared secret	Fast	Hard — must share secret without interception
Asymmetric	Public + private pair	Slow	Solved — public key shared openly

Cambridge tip. Mark scheme rewards the precise terms: PLAINTEXT, CIPHERTEXT, KEY. Use them.

In symmetric encryption, sender and receiver use the SAME secret key.

Process:

1. Both parties agree on a key (somehow).
2. Sender encrypts plaintext using the key → ciphertext.
3. Sender transmits ciphertext.
4. Receiver decrypts using the SAME key → plaintext.

Examples of symmetric algorithms:

• AES (Advanced Encryption Standard) — the modern standard.
• DES, 3DES — older, mostly retired.

Strengths:

• Fast. Symmetric algorithms are computationally cheap. Suitable for encrypting GBs of data in real-time.

Weaknesses:

• Key distribution. How do sender and receiver agree on a key without an attacker intercepting it? In the pre-internet world this was a real problem (couriers, vaults). Online, it's still a problem — you can't just send the key in plaintext.
• One key per pair. N parties needing pairwise communication require N(N-1)/2 keys. Doesn't scale.

Cambridge tip. Mark scheme expects the speed advantage AND the distribution problem stated.

Asymmetric encryption uses a PAIR of mathematically-related keys per party:

• Public key: shared openly with anyone.
• Private key: kept secret by the owner.

The relationship between the keys is one-way: data encrypted with the public key can ONLY be decrypted with the corresponding private key, and vice versa. Knowing the public key doesn't reveal the private key (it would take billions of years even with the most powerful computers).

Encrypting a message TO someone:

1. Sender obtains the recipient's PUBLIC key (openly available).
2. Sender encrypts with the recipient's public key → ciphertext.
3. Sender transmits.
4. Recipient decrypts with their own PRIVATE key.

Even if the ciphertext AND the public key are intercepted, the message is unreadable. Only the private-key holder can decrypt.

Digital signatures (the reverse direction):

1. Sender encrypts (a hash of) the message with their OWN PRIVATE key → signature.
2. Anyone can decrypt the signature using the sender's public key.
3. If the decrypted hash matches the message hash, the signature is valid → confirms WHO sent the message and that it wasn't modified.

Examples of asymmetric algorithms:

• RSA — the original and still widely used.
• ECC (Elliptic Curve Cryptography) — smaller keys, equivalent security.

Strengths:

• No key-distribution problem. Public keys can be shared freely.
• Enables digital signatures and authentication.

Weaknesses:

• Slow. Computationally expensive — orders of magnitude slower than symmetric.
• Only practical for small amounts of data.

Cambridge tip. Top-band candidates remember: encrypt with RECIPIENT'S public key; decrypt with YOUR OWN private key. Reverse for signatures (sign with YOUR OWN private; verify with sender's public).

Modern secure communication (HTTPS, SSL/TLS, WhatsApp, etc.) combines both approaches to get the best of each.

The hybrid pattern:

1. Asymmetric handshake. Browser and server use asymmetric crypto to securely agree on a SHARED SYMMETRIC KEY (called a session key). The session key never travels in plaintext — it's encrypted with the server's public key.

2. Symmetric data exchange. Once both have the session key, they switch to symmetric encryption (fast) for all subsequent data.

3. End of session. Session key is discarded. Next connection generates a fresh one.

Why this works:

• Solves key distribution (asymmetric).
• Enables fast bulk transfer (symmetric).
• Forward secrecy: if a session key is compromised later, only that one session is affected.

Where you've used this today. Every HTTPS website, every secure messaging app, every banking transaction. The padlock in your browser bar means TLS is doing exactly this.

Cambridge tip. Top-band evaluation answers note this hybrid approach. It demonstrates real-world understanding beyond textbook descriptions.