What it means
Symmetric algorithms are efficient for protecting large amounts of data but require secure key distribution and storage. Asymmetric algorithms support key establishment, digital signatures, and identity-related functions, but are more computationally expensive and are not normally used alone to encrypt bulk data.
How it works
Modern protocols combine the two approaches. Asymmetric cryptography authenticates parties or establishes shared secret material, then symmetric encryption protects the session's data. Security still depends on algorithm selection, key size, random-number generation, implementation, certificate validation, and key lifecycle management.
A secure web connection uses public-key mechanisms to authenticate the server and establish session secrets, then uses fast symmetric encryption to protect the actual application traffic.
Practical focus
- Choose approved algorithms and key sizes for the required lifetime
- Protect private and symmetric keys according to their consequences
- Use authenticated encryption for data confidentiality and integrity
- Plan rotation, revocation, backup, and cryptographic agility
Common mistakes
- Calling hashing a form of encryption
- Assuming asymmetric encryption removes key-management problems
- Inventing custom cryptographic combinations instead of using reviewed protocols
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: