Encryption Basics: Symmetric vs Asymmetric

Encryption is the mathematical machinery behind almost every security guarantee you rely on: HTTPS, password managers, disk encryption, signed software updates. You do not need to be a cryptographer to use it well, but you do need to know which tool fits which job. This lesson compares the two great families, symmetric and asymmetric encryption, and shows how real systems combine them.

Symmetric Encryption

Symmetric encryption uses one shared secret key for both encryption and decryption. The standard algorithm today is AES (Advanced Encryption Standard), typically AES-256, which is extremely fast, hardware-accelerated on modern CPUs, and considered secure against any known attack when used correctly.

Strengths:

Very fast, suitable for bulk data: files, database fields, network streams.
Small keys (256 bits) provide enormous security margins.

The catch is key distribution: both parties must somehow share the secret first, and if you could already share secrets safely, you would not need encryption. Symmetric encryption alone also does not tell you who you are talking to.

Using symmetric encryption safely

Always use an authenticated mode such as AES-GCM, which detects tampering, and never reuse a nonce with the same key:

javascript

// AES-256-GCM encryption in Node.js (authenticated encryption)
const crypto = require('crypto');

function encrypt(plaintext, key) {
  const iv = crypto.randomBytes(12);            // unique nonce every time
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
  const tag = cipher.getAuthTag();              // integrity check
  return { iv, ciphertext, tag };
}

function decrypt({ iv, ciphertext, tag }, key) {
  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
  decipher.setAuthTag(tag);                     // throws if data was tampered
  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
}

Asymmetric Encryption

Asymmetric (public-key) cryptography uses a mathematically linked key pair: a public key you share with the world and a private key you guard. Data encrypted with the public key can only be decrypted with the private key. Common algorithms are RSA and elliptic-curve schemes such as ECDH and Ed25519.

This solves key distribution: anyone can encrypt a message to you using your public key, with no prior shared secret. Reversing the roles gives digital signatures: you sign with your private key, and anyone can verify with your public key that the message came from you and was not altered. Signatures power TLS certificates, signed git commits, JWT tokens and software update verification.

The costs: asymmetric operations are hundreds of times slower than AES and work on small payloads, so nobody encrypts large files with RSA directly.

Hybrid Encryption: The Best of Both

Real protocols combine the families. TLS, PGP and modern messaging apps all follow the same pattern:

Use asymmetric cryptography (for example an ECDH key exchange) to safely agree on a random session key.
Use fast symmetric AES with that session key for all the actual data.

TLS 1.3 additionally uses ephemeral keys per session, giving forward secrecy: even if a server's long-term private key leaks later, past recorded traffic cannot be decrypted.

Hashing Is Not Encryption

A quick distinction that trips up beginners: hashes (SHA-256, bcrypt) are one-way and have no key; you can never get the input back. Encryption is two-way by design. Use hashing for integrity checks and password storage, encryption for data you need to read again.

Practical Rules for Developers

Never invent your own algorithm or protocol; use vetted libraries (libsodium, your platform's crypto module).
Prefer high-level APIs with safe defaults over assembling primitives yourself.
Protect keys with a secrets manager or KMS; a perfect algorithm with a leaked key protects nothing.
Plan for rotation: design so keys can be replaced without re-architecting.

Key Takeaways

Symmetric (AES-GCM) is fast and ideal for bulk data but requires a shared key.
Asymmetric (RSA, elliptic curves) solves key exchange and enables digital signatures.
Real systems are hybrid: asymmetric to agree on a key, symmetric for the data.
Hashing is one-way and serves different purposes than encryption.
Use established libraries and guard your keys.

Next lesson: Understanding SQL Injection and How to Prevent It, our first deep dive into an application-level attack.