CodeParkSymmetric cryptography uses one shared key for both operations. Asymmetric cryptography uses a pair of keys: one public and one private.
Symmetric examples are AES-GCM for encryption and HMAC for authentication (proving who sent a message). Symmetric crypto is fast, so it suits large amounts of data. But it has two problems:
- Anyone who can decrypt or verify can also encrypt or sign.
- The key has to reach every party in a secure way.
Asymmetric cryptography uses a key pair. The public key can be shared freely. The private key never leaves its owner. It works like this:
- Data encrypted with the public key can only be decrypted with the private key.
- Signatures made with the private key are verified with the public key.
RSA, ECDSA and Ed25519 are examples. They are much slower than symmetric crypto.
In practice, backends combine the two. TLS (the encryption behind HTTPS) uses asymmetric crypto to prove the server's identity and agree on a shared key. Then it uses symmetric encryption for the actual traffic. RS256 JWTs use asymmetric signatures.
- Symmetric crypto uses one shared key and is fast.
- Asymmetric crypto uses a public and private key pair and is slower.
- The public key encrypts or verifies. The private key decrypts or signs.
- TLS combines both: asymmetric to agree on a key, symmetric for the traffic.
- Symmetric examples are AES-GCM and HMAC. Asymmetric examples are RSA, ECDSA and Ed25519.