Symmetric and Asymmetric

Modern encryption splits into two families based on how keys work:

• Symmetric: the same key encrypts and decrypts. Example: AES.
• Asymmetric: a key pair, where one key encrypts and a different key decrypts. Example: RSA.

Real systems combine both. Understanding their trade-offs is essential for attacking and defending crypto.

In symmetric encryption, both parties share one secret key. The same key locks and unlocks the data.

• Pro: very fast, ideal for large amounts of data.
• Con: you must securely share the key first. This is the key distribution problem.

AES (Advanced Encryption Standard) is the dominant symmetric cipher. It is a block cipher operating on 128-bit blocks with key sizes of 128, 192, or 256 bits.

AES is fast, hardware-accelerated on modern CPUs, and considered secure when used correctly. AES-256 is the common high-security choice.

A block cipher needs a mode of operation to handle data larger than one block:

• ECB: insecure; identical blocks produce identical ciphertext, leaking patterns. Avoid.
• CBC: chains blocks with an initialization vector (IV). Better, but needs care.
• GCM: provides both encryption and authentication (AEAD). The modern recommended mode.

A famous demonstration: encrypting an image of a penguin with AES in ECB mode still shows the penguin's outline. ECB encrypts identical plaintext blocks to identical ciphertext blocks, so structure leaks through.

This is why you should recognize ECB as a finding during assessments. The cipher is strong; the mode is the weakness.

Asymmetric encryption uses a mathematically linked key pair:

• Public key: shared freely. Anyone can encrypt to you with it.
• Private key: kept secret. Only you can decrypt with it.

This solves key distribution: you can publish your public key openly without compromising security.

RSA is the classic asymmetric algorithm. Its security rests on the difficulty of factoring the product of two large primes.

Key sizes of 2048 bits are common today; 3072 or 4096 bits give a larger margin. RSA is slow compared to AES, so it is rarely used to encrypt bulk data directly.

Asymmetric keys do two distinct jobs:

• Confidentiality: encrypt with the recipient's public key; only their private key decrypts.
• Authenticity (signing): sign with your private key; anyone verifies with your public key, proving it came from you.

Notice the keys are used in opposite roles for these two purposes.

Real protocols like TLS combine both. The flow:

• Use slow asymmetric crypto once to securely exchange a random session key.
• Use fast symmetric AES with that session key for the actual data.

This gives you the speed of symmetric encryption with the key-distribution convenience of asymmetric encryption.

Diffie-Hellman lets two parties agree on a shared secret over an insecure channel without ever sending the secret itself. It underpins modern TLS key exchange.

Elliptic Curve variants (ECDH, ECDSA) achieve the same security as RSA with much smaller keys, making them faster and increasingly the default.

Strong algorithms fail through bad usage. Watch for these findings:

• ECB mode leaking plaintext patterns.
• Reused or predictable IVs/nonces in CBC or GCM.
• Hardcoded keys in source code or config files.
• Small RSA keys (512 or 1024 bits) that can be factored.
• Padding oracle behavior revealing plaintext one byte at a time.

The math is rarely broken; the implementation usually is.

Apply your understanding of public and private keys.

You compared the two encryption families:

• Symmetric (AES): one shared key, fast, but key distribution is hard. Use GCM mode, never ECB.
• Asymmetric (RSA, ECC): public/private key pair, solves distribution, but slow.
• Encrypt with the recipient's public key; sign with your private key.
• Hybrid systems and Diffie-Hellman combine the best of both in TLS.

Next: identifying and cracking hashes in practice.