Compare symmetric and asymmetric encryption, and describe their roles in securing data in transit and at rest

What this dot point is asking

NESA wants you to compare symmetric and asymmetric encryption on speed, key management, and typical use case, then explain how real systems combine both - especially HTTPS, the most-examined example.

The answer

Symmetric encryption

One shared key is used to encrypt and decrypt. The same key that scrambles the data unscrambles it.

• Algorithm: AES (Advanced Encryption Standard) with key sizes of 128, 192, or 256 bits.
• Speed: very fast, can encrypt gigabytes per second on commodity hardware.
• Key management problem: both parties need the key before they can communicate. Distributing the key securely is the hard part.
• Typical use: encrypting data at rest (databases, files), bulk encryption of session traffic once a session key has been established.

Asymmetric encryption

A key pair: a public key (shared with everyone) and a private key (kept secret by the owner). Data encrypted with the public key can only be decrypted with the private key.

• Algorithm: RSA (typical key size 2048 or 4096 bits), or Elliptic Curve Cryptography (smaller keys, same security).
• Speed: much slower than symmetric, roughly 1000x slower per byte.
• Key management: solves the key exchange problem. You can publish your public key anywhere; only you can decrypt messages sent to it.
• Typical use: key exchange, digital signatures, certificates.

The hybrid model: HTTPS

Real systems combine both. HTTPS is the canonical example: asymmetric encryption for the handshake (key exchange), then symmetric encryption for the bulk traffic. The diagram shows the four-step handshake.

1. The browser opens a TCP connection to the server.
2. The server sends its TLS certificate, which contains its public key.
3. The browser verifies the certificate against a list of trusted certificate authorities.
4. The browser generates a random session key (symmetric).
5. The browser encrypts the session key with the server's public key and sends it.
6. The server decrypts the session key with its private key.
7. All subsequent traffic in the session is encrypted with the symmetric session key.

Asymmetric encryption is used only for the handshake. The actual data is protected by fast symmetric encryption.

Worked code

A short Python example using the cryptography library:

from cryptography.fernet import Fernet

# Symmetric: AES under the hood
key = Fernet.generate_key()
cipher = Fernet(key)

message = b"transfer $5000 to account 123"
encrypted = cipher.encrypt(message)
decrypted = cipher.decrypt(encrypted)
assert decrypted == message

For asymmetric:

from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes

private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = private_key.public_key()

message = b"session key here"
encrypted = public_key.encrypt(
    message,
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                 algorithm=hashes.SHA256(), label=None)
)
decrypted = private_key.decrypt(
    encrypted,
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                 algorithm=hashes.SHA256(), label=None)
)
assert decrypted == message