Symmetric vs Asymmetric encryption

Ever wonder how encryption actually works? Here, we’ll look at the two main approaches: symmetric, which is fast and straightforward, and asymmetric, which is a bit slower but incredibly powerful for secure communication.

Introduction

In the previous post we introduced the concept of cryptography by using and breaking the Caesar cipher. However, the Caesar cipher is millennia behind cryptography as it stands today. The simplicity that makes it an excellent teaching tool is exactly what renders it obsolete.

In this post we will use the knowledge we’ve gained to introduce modern cryptographic concepts. Specifically, the two buckets of encryption algorithms: asymmetric and symmetric. This might sound scary, but there is more overlap than you think. The Caesar cipher pioneered many of these concepts.

The problem and how we got here

Building on our understanding of the Caesar cipher, let’s fast forward to the post-World War II era, a time of rapid technological advancement and increasing global tensions.

Imagine it’s the early 1970s. The Cold War is in full swing, and you’re working for a U.S. government agency. Your job involves transmitting sensitive information - military strategies, diplomatic communications, and intelligence reports - across vast distances using the latest computer networks.

But there’s a problem. The encryption methods you’re using, while more advanced than the Caesar cipher, are still vulnerable to the ever-increasing compute power of the era. You know that adversaries are constantly trying to intercept and decrypt your communications. A breach could have catastrophic consequences for national security.

This scenario wasn’t just a hypothetical - it was the reality faced by governments, military organisations, and financial institutions in the post-war period. As these sectors became increasingly digitalized, they faced several critical challenges:

1. The need for stronger encryption: Traditional methods were becoming easier to break as computer processing power grew.
2. Standardization: Different organizations were using various encryption methods, making secure communication between them difficult.
3. Speed: With the increasing volume of digital communications, encryption needed to be fast enough to not slow down operations.
4. Adaptability: The method needed to be flexible enough to be implemented across different computer systems and networks.

The Caesar cipher and other encryption methods at the time were not able to overcome these challenges. This led to the development of the Data Encryption Standard (DES) in the mid-1970s. DES marked the beginning of the modern era of encryption and was the first publicly available cipher approved by the U.S. National Bureau of Standards.

The Fundamentals of Modern Cryptography - Symmetric Encryption

Much like the Caesar Cipher, DES used a single key to both encrypt and decrypt messages. It operated using a shared key between the parties communicating. At the time this was standard practice, it was just known as encryption. However, today an encryption algorithm that uses the same key for both encryption and decryption is known as a “symmetric encryption algorithm” (we’ll see why it’s called that later on). Let’s demonstrate what a modern symmetric encryption algorithm looks like in practice.

The process begins with the original message you want to keep secret known as the plaintext. The sender takes the plaintext input and runs it through a symmetric encryption algorithm. This algorithm modifies the data using a set of pre-defined procedures to create an output that is specific to the key, known as the ciphertext. The ciphertext is seemingly random data that has no resemblance to the original plaintext message.

The ciphertext can then be safely transmitted over unsecured networks, as it should be unintelligible to anyone intercepting it. When the intended recipient receives the ciphertext, they use the same key to decrypt the message using the same encryption algorithm. If they have the correct key, the algorithm outputs the original plaintext 🎉.

The key is crucial here. It’s a string of bits that acts as a ‘recipe’ for how the encryption algorithm should modify the data. Without knowing the key it should be impossible to retrieve the original plaintext from the output, even if you know the encryption algorithm being used.

This high level process is exactly how DES works, it uses a 56-bit key to break the plaintext into 64-bit blocks and modifies those blocks through 16 rounds of complex operations. However, today DES itself is no longer considered secure due to advances in computing power, its successor, the Advanced Encryption Standard (AES), uses the same fundamental principles with larger keys (128-256 bits).

Benefits and limitations

Symmetric encryption is difficult to break, can encrypt/decrypt large volumes of data quickly, and provides standardized solutions that can be implemented across systems. It is broadly used today and is still the fastest form of encryption.

One of the greatest things about symmetric encryption is that it is conceptually simple (apart from the complex mathematics behind it). Both the sender and the recipient only need to worry about keeping a single piece of information secret - the key. As long as the key remains secure, the communication remains private.

However, this simplicity also points to one of the major challenges of symmetric cryptography: key distribution. How do you securely share the secret key with your intended recipient? This challenge would eventually lead to further innovations in the field of cryptography and the invention of ✨ Asymmetric Encryption ✨.

Introduction to Asymmetric Cryptography

Imagine you’re a spy in the 1970s. You communicate with other agents over secure channels that use symmetric encryption, but you face a constant challenge: securely exchanging keys with your fellow agents. So how would you do that?

You can’t send the key without encryption and you can’t use the same key for all communications - if the key is compromised, all communications with all agents would be at risk. Every time you meet to exchange keys, you risk exposure. This was the puzzle that cryptographers of the time were trying to solve. How could you establish a secure connection with someone you’ve never met, over a public network like the internet, without any prior exchange of secret information?

In 1976, two brilliant minds, Whitfield Diffie and Martin Hellman, proposed a groundbreaking idea that would transform the field of cryptography. Their concept, which became known as asymmetric or public-key cryptography, was so revolutionary that many initially thought it was impossible.

The core idea of asymmetric cryptography is this: instead of using a single key for both encryption and decryption, why not use two different but mathematically related keys? One key would be public, freely shared with anyone. The other would be private, kept secret by the owner. Information encrypted with the public key could only be decrypted with the corresponding private key.

Here’s how it works in practice:

1. Key Generation: When you want to receive secure messages, you generate a pair of keys - a public key and a private key. These keys are mathematically linked, but it’s impossible to derive the private key from the public key.
2. Key Distribution: You freely distribute your public key. You can post it on your website, email it to colleagues, or even publish it in a newspaper. The more widely available your public key is, the better.
3. Encryption: When someone wants to send you a secret message, they encrypt it using your public key. This creates a ciphertext that can only be decrypted with your private key.
4. Decryption: When you receive the encrypted message, you use your private key to decrypt it and read the original plaintext.

Benefits and limitations

Asymmetric encryption elegantly solves the key distribution problem of symmetric cryptography. There’s no need for a secure channel to exchange keys because the public key can be freely distributed. Even if someone intercepts the public key, they can’t use it to decrypt messages - only to encrypt them.

It also enables you to verify the authenticity and integrity of messages or documents through digital signatures. This is done by encrypting a message with your private key, you create a signature that anyone can verify using your public key, proving that the message came from you and hasn’t been tampered with.

The first practical implementation of asymmetric cryptography came in 1977 with the Rivest–Shamir–Adleman (RSA) algorithm, named after its inventors Ron Rivest, Adi Shamir, and Leonard Adleman. RSA quickly became the standard for secure data transmission and is still widely used today.

However, asymmetric cryptography isn’t without its challenges. The mathematical operations involved are much more complex than those in symmetric cryptography, making it significantly slower. For large amounts of data, the performance difference can be substantial.

This trade-off between the key distribution of asymmetric cryptography and the speed of symmetric cryptography led to the development of hybrid systems. These hybrid systems would come to dominate modern secure communication protocols, giving us the best of both worlds.

Hybrid cryptography systems: the best of both worlds

Both symmetric and asymmetric cryptography have their strengths and weaknesses. Symmetric encryption is fast and efficient, ideal for encrypting large amounts of data, but struggles with key distribution. Asymmetric encryption solves the key distribution problem brilliantly but is computationally intensive and slow for large data sets. So, how do we get the best of both worlds? Enter hybrid cryptography systems.

Imagine you’re designing the security system for a popular messaging app. You want the speed of symmetric encryption to handle the millions of messages sent every day, but you also need the secure key exchange capability of asymmetric encryption. This is exactly the kind of problem that hybrid cryptography systems solve.

Here’s how a hybrid system typically works:

1. Session Key Generation: When two parties want to communicate, one of them generates a random symmetric key, often called a session key. This key will be used just for this one conversation or data transfer session.
2. Key Exchange: The session key is encrypted using the recipient’s public key (asymmetric encryption). This encrypted key can be safely sent over an unsecured network because only the recipient, who has the corresponding private key, can decrypt it.
3. Data Encryption: Once both parties have the session key, they use it to encrypt and decrypt the actual messages or data using symmetric encryption.

This hybrid approach is the sweet spot that offers the best of both worlds. It works well for all data sizes and is fast - the bulk of the data is encrypted using fast symmetric encryption. From a security perspective, the symmetric key is securely exchanged using asymmetric encryption and it’s even possible to generate a new symmetric key for each session.

Hybrid systems are not just theoretical - they’re the backbone of much of our secure digital communication today. When you see that little padlock icon in your browser’s address bar, indicating a secure HTTPS connection, you’re seeing a hybrid system in action. The TLS (Transport Layer Security) protocol, which powers HTTPS, uses a hybrid approach to establish secure connections between your browser and web servers. Before wrapping up, let’s walk through how TLS works so you can see encryption applied to a difficult real-world problem.

Real World Encryption: TLS

In practice, asymmetric and symmetric encryption algorithms are often combined to solve hard problems. To demonstrate this, let’s look at the most widely used application of cryptography: Transport Layer Security (TLS), formerly known as Secure Sockets Layer (SSL).

TLS is a cryptographic protocol designed to provide secure communication over computer networks. It is used to secure almost all virtual data transfers on the internet today. For example, modern websites use TLS for secure end-to-end communication. Modern browsers even visually highlight if you are securely connected to a website through TLS, just look at the padlock icon next to the left of your browser’s address bar. Yep, that’s TLS!

So how does TLS work? Does it use an asymmetric algorithm? Symmetric? The answer is both. TLS uses asymmetric cryptography to communicate a symmetric key that is then used for subsequent communication. By doing so TLS leverages the best of both worlds. TLS uses asymmetric cryptography to overcome the trust establishment problems of symmetric cryptography. While also using symmetric cryptography to overcome the speed issues of asymmetric cryptography.

This probably sounds unnecessarily complicated and confusing so let’s walk through a practical example to demonstrate. Consider the following simplified diagram:

1. The client opens the connection and says hello. This exchange is not encrypted.
2. The server replies with its public key. Anyone watching the network can read it, and that’s fine, because a public key only encrypts.
3. The client generates a symmetric key, encrypts it with the server’s public key, and sends it over. Only the server, holding the matching private key, can decrypt it. Both sides now share a secret that never travelled in the clear.
4. From here on, the client encrypts its requests with that shared symmetric key.
5. The server decrypts them, and encrypts its responses with the same key.

The benefit of this approach is that TLS gets the best of both worlds. We are able to leverage asymmetric cryptography to establish trust, while also getting the speed of symmetric cryptography. This makes encryption accessible, usable and raises the bar of application security. Again, almost all modern applications leverage TLS in some way, shape, or form.

Conclusion

As we conclude our journey through modern cryptography, let’s take a moment to reflect on what we’ve learned and consider its implications.

We began by exploring the limitations of ancient ciphers like the Caesar cipher, which led us to the development of more sophisticated encryption methods. We explored symmetric encryption, understanding its speed and efficiency, but also recognizing its key distribution challenge. This challenge paved the way for the revolutionary concept of asymmetric encryption, which solved the key exchange problem but introduced its own performance limitations.

The clever solution to these trade-offs came in the form of hybrid systems, combining the strengths of both symmetric and asymmetric encryption. We saw how these hybrid systems form the backbone of many secure communication protocols we use daily, from HTTPS for secure web browsing to end-to-end encrypted messaging apps.

A few key themes emerged along the way:

1. The constant balance between security and usability in cryptographic systems.
2. The iterative nature of cryptographic development, with each innovation addressing the limitations of previous methods.
3. The critical role of cryptography in modern security, often operating behind the scenes to keep our data secure.

We’ve only scratched the surface of symmetric and asymmetric cryptography here, and that’s intentional. Cryptography is deep enough to fill a shelf of books; the goal of this series is the foundation, not the depth. The key takeaway (no pun intended) is an awareness of both techniques, what each one is good at, and why almost every real system reaches for both.

In the next post in this series, we’ll cover the last cryptography concept we need: hashing. Hashing is everywhere in modern applications, from password storage to verifying the integrity of transmitted data. Let’s do it.